CVE-2026-122235

Jan workspace checks can follow a dangling symlink to a host file

Jan · Jan desktop and CLI agent write/edit tools

First documented disclosure · Review checkpoint

Summary

An agent approved to write inside an untrusted repository can create a user-writable file outside it.

Severity and exploitation evidence

Medium · 5.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The advisory gives a controlled reproduction using a dangling link. It does not report production exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

When a symlink’s target did not exist, path validation fell back to a lexical workspace path. The subsequent host write followed the symlink to its real destination.

Conditions required

The workspace contains a dangling symlink to a nonexistent file in a writable location. The agent has permission to write or edit and is induced to use that path.

Potential impact

Attacker-chosen content can be written outside the project. Writing a login, shell or startup file may enable subsequent access or execution, depending on the destination and system configuration.

Affected versions and configurations

0.8.5 through 0.8.7, per the CNA. Jan identifies affected desktop and CLI write tools.

Fix and mitigation status

0.8.8 resolves links during validation and prevents following a final symlink during file opening.

Practical next steps

Upgrade and avoid granting write access to untrusted workspaces until patched. Review user-writable startup and authentication files if exposure is suspected.

Operating lesson

Check the resolved write target even when it does not exist, and prevent link swaps between approval and file opening.

Evidence and limits

The October 23 public fix proposal predates the October 28 release, October 29 advisory and November 4 CVE. The demonstrated primitive is a file write. Further execution depends on the chosen file.

Sources