Is CVE-2026-122235 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122235 being exploited in the wild.

How severe is CVE-2026-122235?

Medium severity, with a CVSS score of 4.7, published 4 November 2026.

Is there a fix for CVE-2026-122235?

Yes: fixed in 0.8.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-122235 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-122235?

Check whether you run Jan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122235: Jan workspace guard bypass in agent-tools via symlinks

CVE-2026-122235 · Severity: medium · CVSS 4.7 · Published 2026-11-04

Jan is an AI application framework that allows users to run local AI models. A vulnerability in versions 0.8.5 through 0.8.7 allows attackers to bypass workspace file protection through dangling symlinks, enabling them to write arbitrary files to the user's system such as ~/.ssh/authorized_keys. An attacker can exploit this by supplying a malicious code repository that uses prompt injection to trick the write/edit tools into following symlinks outside the protected workspace.

Technologies: Jan. Vendors: Jan.

Quick answers

Is CVE-2026-122235 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122235 being exploited in the wild.
How severe is CVE-2026-122235?: Medium severity, with a CVSS score of 4.7, published 4 November 2026.
Which products and versions are affected?: Jan 0.8.5 to 0.8.7.
Is there a fix for CVE-2026-122235?: Yes: fixed in 0.8.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122235 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-122235?: Check whether you run Jan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.8.8

Technical details

The vulnerability is a workspace guard bypass in gate.rs affecting the agent-tools write and edit operations. The flaw stems from improper symlink resolution: dangling symlinks are canonicalized to their existing ancestor, preserving in-project names that are then approved as legitimate writes, allowing the target file creation outside the workspace. Additionally, symlinks swapped between the path validation check and the file write were still followed. The fix (commit 840c33e) implements proper symlink detection and resolution, walking paths component-by-component with a 40-hop limit and refusing to follow any links, while creating missing parent directories safely.

Affected products

Jan Jan 0.8.5 to 0.8.7

Timeline

2026-11-04: disclosed
2026-10-23: patched: Fix committed to main branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.