CVE-2026-88937

knowns through version 0.33.0 fails to properly validate template destination paths in its code-generation template engine, a path-traversal flaw (CWE-22) that lets attackers read and write arbitrary files outside the project root. The flaw is triggered when a user applies a maliciously crafted template, for example one obtained from an untrusted repository or shared source, allowing directory-traversal sequences in destination paths to escape the project directory (the CVSS 4.0 vector indicates a network attack vector with user interaction required). By writing outside the project root, an attacker can overwrite shell profiles such as .bashrc or .zshrc, plant persistence, steal stored credentials, and ultimately achieve persistent code execution on the victim system. Any developer or CI environment running knowns 0.33.0 or earlier with attacker-influenced templates is affected. There are currently no known exploits, no public proof-of-concept, and the issue is not in CISA's Known Exploited Vulnerabilities catalog, though the 8.6 (High) CVSS 4.0 score reflects high confidentiality, integrity, and availability impact.

What to do: Upgrade beyond 0.33.0 as soon as a patched release is published (no fixed version is specified in current data) and, until then, only use templates from fully vetted, trusted sources. Audit systems that have processed third-party templates for unexpected modifications to shell startup files (~/.bashrc, ~/.zshrc, ~/.profile), SSH keys, and credential stores, and review any template destination paths for traversal sequences.