CVE-2026-88939

knowns through version 0.33.0 unconditionally exempts the project.set action from its permission guard checks, an incorrect-authorization flaw (CWE-863). A session that is supposed to be read-only can invoke project.set, which repoints the server at a different project directory and thereby grants the session write-access capabilities it should not have. An attacker holding any low-privileged agent session can escalate from read-only to write access over the network, with no user interaction required, and both confidentiality and integrity of the reachable project data are rated at high impact. Anyone running knowns up to and including 0.33.0 who relies on its permission guards to constrain agent sessions is affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not listed in CISA's KEV.

What to do: Check upstream for a release newer than 0.33.0 that restores the permission guard on project.set and upgrade, since no fixed version is specified in the available data. As interim mitigation, restrict which agent sessions can reach the project.set action (e.g., via network ACLs or proxy rules) and review the current project-directory configuration for signs of unauthorized repointing. Until patched, treat all read-only agent sessions as potentially able to gain write access.