CVE-2026-108751
MEDIUM
4,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
4,4
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: low
Description
AI Translation Available
MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so atomicWriteFile truncates and overwrites victim-writable files with MoAI template content.
59
Improper Link Resolution Before File Access ('Link Following')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Other
Potential Impacts:
Read Files Or Directories
Modify Files Or Directories
Bypass Protection Mechanism
Execute Unauthorized Code Or Commands
Applicable Platforms
Operating Systems:
Windows, Unix
https://github.com/modu-ai/moai-adk
https://github.com/modu-ai/moai-adk/blob/4b2f203feda9c2cb6d7771969f4ec966842c87…
https://github.com/modu-ai/moai-adk/blob/4b2f203feda9c2cb6d7771969f4ec966842c87…
https://hackmd.io/@haind/moai-adk-template-staging-symlink-overwrite
https://www.vulncheck.com/advisories/moai-adk-through-3.1.2-symlink-following-v…