Is CVE-2026-88939 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-88939?

CVE-2026-88939 has a CVSS v3 severity of HIGH (8.3).

Back

CVE-2026-88939

Description

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities.