Project-Mount Symlink Traversal in brig: How a Sandbox Reaches Host Directories It Was Never Given

Brig versions earlier than 0.3.0 contained a high-severity project-mount symlink traversal vulnerability, tracked as GHSA-wp6x-29qx-fpr7 and ENDOR-VUL-2026-1809, that could let an AI agent access arbitrary host directories despite running in a sandbox or microVM. Because Brig passed user-supplied project paths to its runtime without securely resolving them, an agent with write access to a mounted repository could replace a subdirectory with a symlink to sensitive host locations; if an operator later launched a run targeting that subdirectory, the runtime would mount the symlink target read-write into the sandbox. The issue was confirmed on macOS microVM and Linux container configurations and could expose or modify SSH keys, cloud credentials, other projects, Brig session data, and potentially files enabling host-level code execution. It was classified as CWE-59, improper link resolution, rather than a hypervisor or guest-kernel escape, because Brig itself acted as a confused deputy when requesting the host mount. Version 0.3.0 fixes the flaw by safely resolving project paths, rejecting symlinks in sandbox-writable path components, and preserving path identity through the runtime handoff; users unable to upgrade are advised to provide a manually resolved physical project path and treat paths beneath previously writable project mounts as untrusted.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.