Loading vulnerability…
Host environment secret exposure in mini-swe-agent BubblewrapEnvironment
mini-swe-agent versions 1.10.0 through 2.4.6 contain an information exposure vulnerability in BubblewrapEnvironment. Its bwrap invocation omits --clearenv, causing sandboxed commands to inherit the host environment. Prompt injection in processed task content can induce the agent to read API keys and other secrets from inherited environment variables and exfiltrate them over the shared network.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation discloses API keys and other secrets present in the agent's host environment. The sandbox fails to isolate these environment variables, and shared network access enables their exfiltration.
If you can’t patch tonight, do this now.
As interim, root-cause-derived measures, remove secrets from the agent's host environment and restrict sandbox network egress. These measures are not identified as explicitly documented workarounds.
Patch, then assume compromise.
Modify BubblewrapEnvironment to invoke bwrap with --clearenv and explicitly supply only necessary, non-sensitive environment variables. This remediation is derived from the identified root cause; no patch or fixed release is identified.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.