CVE-2026-128079

A requirements file could expose host data during an envd build

TensorChord · envd environment builder for agents

First documented disclosure · Review checkpoint

Summary

The build process read Python dependency files on the host without reliably confining access to the build context. Host file contents interpreted as dependencies could appear in build metadata or debug logs, limited by the builder’s privileges.

Severity and exploitation evidence

Medium · 6.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The maintainer describes a regression test of file access behavior. Its advisory distinguishes that test from an end-to-end disclosure and identifies no malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The build process read Python dependency files on the host without reliably confining access to the build context.

Conditions required

A party could influence build input. Version 1.3.5 additionally requires concurrent filesystem changes.

Potential impact

Host file contents interpreted as dependencies could appear in build metadata or debug logs, limited by the builder’s privileges.

Affected versions and configurations

0.3.38 through versions before 1.3.6.

Fix and mitigation status

1.3.6.

Practical next steps

Upgrade envd to 1.3.6 or later, isolate untrusted builds and restrict access to build diagnostics.

Operating lesson

Apply the build-context boundary to files read by the host process.

Evidence and limits

The CVE record was published on 2026-11-13.

Sources