CVE-2026-108592

mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.

CVSS 4.0

6.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-25)

CWE

CWE-526

Published

2026-10-10

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://github.com/SWE-agent/mini-swe-agent
• https://github.com/SWE-agent/mini-swe-agent/blob/v2.4.6/src/minisweagent/environments/extra/bubblewrap.py#L38-L103
• https://hackmd.io/@haind/minisweagent-bubblewrap-host-environment-leak
• https://www.vulncheck.com/advisories/mini-swe-agent-1.10.0-through-2.4.6-environment-exposure-via-bubblewrapenvironment

Check your stackJSON