{
  "entry": {
    "kind": "vuln",
    "slug": "ghsa-wp6x-29qx-fpr7",
    "name": "GHSA-wp6x-29qx-fpr7",
    "vendor": "brig",
    "description": "brig is a Go tool for running AI coding agents such as Claude Code inside a container or microVM sandbox. It mounted the project the operator named read-write without resolving the path first, refusing only a path that resolved to /. Because the agent can write to the project, it can replace a subdirectory with a symlink to any host directory, and on the next run that names that subdirectory the runtime follows the link on the host and exports the target read-write into the sandbox, exposing ~/.ssh, ~/.aws, ~/.config/gh/hosts.yml, brig's own state and other sessions' guest homes; write access to authorized_keys or a shell startup file then gives code execution as the user. The hypervisor and guest-kernel boundaries are not broken (brig acts as a confused deputy), and --network isolated or offline does not stop it. The maintainers published GHSA-wp6x-29qx-fpr7 (CVSS 3.1 8.2) and released the fix in 0.3.0 on 26 September 2026; the bug arrived on 1 September with the named-project feature. Endor Labs researcher Peyton Kennedy published the write-up on 28 September, reproduced on macOS 15 and Ubuntu 24.04 including reading a host SSH key. No CVE had been assigned at publication.",
    "website": "https://www.endorlabs.com/learn/project-mount-symlink-traversal-in-brig-how-a-sandbox-reaches-host-directories-it-was-never-given",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-26",
    "risk": {
      "score": 82,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "GHSA-wp6x-29qx-fpr7",
      "aliases": [
        "ti-125"
      ],
      "title": "brig Agent Sandbox: Project-Mount Symlink Traversal Let a Coding Agent Get Any Host Directory Mounted Read-Write (GHSA-wp6x-29qx-fpr7, CVSS 8.2)",
      "summary": "brig is a Go tool for running AI coding agents such as Claude Code inside a container or microVM sandbox. It mounted the project the operator named read-write without resolving the path first, refusing only a path that resolved to /. Because the agent can write to the project, it can replace a subdirectory with a symlink to any host directory, and on the next run that names that subdirectory the runtime follows the link on the host and exports the target read-write into the sandbox, exposing ~/.ssh, ~/.aws, ~/.config/gh/hosts.yml, brig's own state and other sessions' guest homes; write access to authorized_keys or a shell startup file then gives code execution as the user. The hypervisor and guest-kernel boundaries are not broken (brig acts as a confused deputy), and --network isolated or offline does not stop it. The maintainers published GHSA-wp6x-29qx-fpr7 (CVSS 3.1 8.2) and released the fix in 0.3.0 on 26 September 2026; the bug arrived on 1 September with the named-project feature. Endor Labs researcher Peyton Kennedy published the write-up on 28 September, reproduced on macOS 15 and Ubuntu 24.04 including reading a host SSH key. No CVE had been assigned at publication.",
      "severity": "high",
      "cvss": {
        "score": 8.2,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft",
        "Path traversal",
        "Sandbox escape"
      ],
      "componentType": "agent",
      "component": {
        "name": "brig",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "brig (github.com/brig-sh/brig) < 0.3.0; fixed in 0.3.0 (26 September 2026).",
          "fixed": "0.3.0"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-26",
      "modifiedAt": "2026-09-26",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.endorlabs.com/learn/project-mount-symlink-traversal-in-brig-how-a-sandbox-reaches-host-directories-it-was-never-given"
        },
        {
          "type": "advisory",
          "url": "https://github.com/advisories/GHSA-wp6x-29qx-fpr7"
        }
      ],
      "mitigation": "Upgrade brig to 0.3.0 or later, which resolves the project path one component at a time, refuses symlinks below the first writable directory and prints the resolved directory. Until then, pass a resolved path, e.g. `brig run claude \"$(cd <dir> && pwd -P)\"`, and treat any project path that runs through a directory a sandbox previously had read-write as suspect. Rotate SSH keys, cloud credentials and gh tokens on hosts where agents ran under brig < 0.3.0, and keep credentials an agent does not need off those hosts. Network isolation modes do not mitigate this issue.",
      "detectedByAnomity": true
    }
  }
}