CVE-2026-65698
Deferred Deferred - Pending Action

Void Path Traversal in Void AI Agent Tools

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file:// URIs through the read_file, ls_dir, get_dir_tree, and search_* tools, which lack workspace confinement and bypass the approval gate, enabling silent exfiltration of sensitive files such as SSH private keys or cloud credentials via subsequent tool calls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65698
EUVD
EUVD-2026-48312

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
void void 1.3.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in Void's AI agent (versions up to 1.3.4) that allows attackers to read arbitrary files on the host system outside the designated workspace. It occurs because the agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) lack proper path restrictions and approval checks. Attackers can exploit this by injecting malicious instructions into content the agent processes, tricking it into reading sensitive files like SSH keys or cloud credentials without user awareness.

The vulnerability arises from two issues: the validateURI function does not enforce workspace confinement, allowing absolute paths or file:// URIs, and the approval gate only applies to certain tools, leaving file-reading tools unchecked.

Detection Guidance

To detect this vulnerability, monitor for suspicious file access patterns by the Void AI agent. Check logs for read_file, ls_dir, get_dir_tree, or search_* tool calls with absolute paths or file:// URIs outside the workspace. Commands like 'grep -r "read_file" /var/log/void/' or 'journalctl -u void-agent --grep="file://"' may help identify unauthorized file reads.

Impact Analysis

If you use Void's AI agent (v1.3.4 or earlier), an attacker could exploit this to steal sensitive files from your system, such as SSH private keys, cloud credentials, or configuration files. This could lead to unauthorized access to your accounts, data breaches, or further compromise of your system. The attack can happen silently without your knowledge.

Compliance Impact

This vulnerability could lead to data breaches, which may violate compliance requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., exposure of protected health information). Organizations using Void's AI agent may face legal penalties, reputational damage, and increased scrutiny from regulators due to potential non-compliance with data protection standards.

Mitigation Strategies

Immediately upgrade Void to a patched version if available. Restrict the read_file, ls_dir, get_dir_tree, and search_* tools to workspace folders only. Enable approval gates for these tools by updating the approvalTypeOfBuiltinToolName mapping. Disable the AI agent if not required. Monitor network traffic for unusual data exfiltration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65698. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart