Executive brief
Entire CLI is a command-line tool used for managing development checkpoints and sessions. A security flaw allows an attacker with write access to a project's checkpoint repository to create malicious metadata. When a legitimate user attempts to resume a session or rewind a checkpoint, the tool can be tricked into overwriting sensitive files on the user's computer, potentially leading to full system compromise.
Technical details
A path traversal vulnerability exists in Entire CLI due to insufficient validation of the 'SessionID' field within checkpoint metadata. Metadata is fetched from the remote 'entire/checkpoints/v1' branch; because the 'SessionID' is used to construct local filesystem paths without sanitization, an attacker with push access to the repository can inject absolute paths or traversal sequences (e.g., '../'). When a victim executes 'entire session resume' or 'entire checkpoint rewind', the CLI writes attacker-controlled transcript data to unintended locations, such as shell configuration files. This can lead to Remote Code Execution (RCE). The issue is fixed in version 0.7.7 by implementing strict input validation and using traversal-resistant file primitives.
Affected products
- entireio Entire CLI <= 0.7.6
Timeline
- 2026-06-04: other: Fix merged into main branch
- 2026-06-18: disclosed: Vulnerability reported to Entire Security team
- 2026-06-19: advisory: GitHub Advisory published