CVE-2026-111045

Impact

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/anshupriyan/cli-bridge/commit/284a84c5ac4db8dd0e1bc9db81bd15bdc83fcb38
• https://github.com/anshupriyan/cli-bridge/pull/3
• https://github.com/anshupriyan/cli-bridge/releases/tag/v0.0.2
• https://github.com/anshupriyan/cli-bridge/security/advisories/GHSA-8jc4-x8v7-2q9r