CVE-2026-108600 Details

A vulnerability exists in Open Multi-Agent (OMA) versions 1.5.0 through 1.21.2) within the file_write tool. This issue allows for improper link resolution before file access, leading to a path-containment bypass. The vulnerability arises from the way OMA handles dangling symlinks in the filesystem sandbox. When a symlink pointing to a non-existent target is placed in the workspace, it can be exploited by injecting prompts that manipulate the agent into writing content to locations outside the designated workspace root. The created files can contain attacker-controlled information and are placed in sensitive areas accessible to the OMA process.

The vulnerability can be fixed by updating the path resolution logic to check for dangling symlinks before reattaching the final component of the path. Additionally, the file_write tool should be modified to open files with the O_NOFOLLOW flag to prevent following symlinks to outside locations.