{"metadata": {"vulnerability": "CVE-2026-108592", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-09T00:00:00Z", "date_only": false, "value": "2026-10-09T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-108592", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-10T18:08:11.425Z", "date_only": false, "value": "2026-10-10T18:08:11.425Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-108592", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-10T18:16:56.528Z", "date_only": false, "value": "2026-10-10T18:16:56.528Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-108592", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-10T18:16:56.528Z", "date_only": false, "value": "2026-10-10T18:16:56.528Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-108592", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-10T18:30:53.771Z", "date_only": false, "value": "2026-10-10T18:30:53.771949Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117418036640523104", "record": "CVE-2026-108592", "field": "creation_timestamp", "uuid": "41ef9698-a154-448c-a04c-e07d20ace81c", "content": "CVE-2026-108592 mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108592https://hackmd.io/@haind/minisweagent-bubblewrap-host-environment-leakhttps://github.com/SWE-agent/mini-swe-agent/blob/v2.4.6/src/minisweagent/environments/extra/bubblewrap.py#L38-L103https://github.com/SWE-agent/mini-swe-agenthttps://www.vulncheck.com/advisories/mini-swe-agent-1.10.0-through-2.4.6-environment-exposure-via-bubblewrapenvironment#SWE-agent #mini-swe-agent#CVE_2026_108592#bot", "url": "https://infosec.exchange/users/cve/statuses/117418036640523104"}, {"timestamp": "2026-10-10T19:16:57Z", "date_only": false, "value": "2026-10-10T19:16:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P449-R4WM-3HPM", "record": "GHSA-P449-R4WM-3HPM", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-10T19:16:57.463Z", "date_only": false, "value": "2026-10-10T19:16:57.463", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108592", "record": "FKIE_CVE-2026-108592", "field": "published"}, {"timestamp": "2026-10-10T21:31:14Z", "date_only": false, "value": "2026-10-10T21:31:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P449-R4WM-3HPM", "record": "GHSA-P449-R4WM-3HPM", "field": "published"}, {"timestamp": "2026-10-10T21:31:15Z", "date_only": false, "value": "2026-10-10T21:31:15Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P449-R4WM-3HPM", "record": "GHSA-P449-R4WM-3HPM", "field": "modified"}, {"timestamp": "2026-10-11T00:00:11Z", "date_only": false, "value": "2026-10-11T00:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104921", "record": "CVE-2026-108592", "field": "creation_timestamp", "uuid": "923b2b44-e3af-43d0-ab32-66b3c223f6b8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-108592-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a asvorg\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-10 23:55:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-108592 \u2014 Environment Variable Exposure PoC in mini-swe-agent\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104921"}, {"timestamp": "2026-10-11T00:00:11Z", "date_only": false, "value": "2026-10-11T00:00:11.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/104921", "record": "CVE-2026-108592", "field": "creation_timestamp", "uuid": "53447873-0e73-4858-b7e4-4d863cdcbca1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-108592-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a asvorg\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-10 23:55:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-108592 \u2014 Environment Variable Exposure PoC in mini-swe-agent\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104921"}, {"timestamp": "2026-10-14T02:24:38.500Z", "date_only": false, "value": "2026-10-14T02:24:38.500276Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-108592", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T02:24:38.500Z", "date_only": false, "value": "2026-10-14T02:24:38.500276Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108592", "record": "FKIE_CVE-2026-108592", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T02:24:46.600Z", "date_only": false, "value": "2026-10-14T02:24:46.600Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-108592", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T02:24:46.600Z", "date_only": false, "value": "2026-10-14T02:24:46.600Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-108592", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:18:44.867Z", "date_only": false, "value": "2026-10-16T19:18:44.867", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108592", "record": "FKIE_CVE-2026-108592", "field": "lastModified"}]}