The vulnerability arises from a dangling symlink allowed by the file_write tool in open‑multi‑agent. Attackers can place a symlink inside the agent’s workspace and use prompt injection to steer the agent into writing attacker‑controlled data to any location the agent process has write permissions for. Because the symlink is resolved during the file write operation, this allows the agent to write files outside the intended sandbox, potentially overwriting critical configuration files or releasing malicious code that the agent could execute later. The weakness is a classic link‑following flaw identified as CWE‑59.

All versions of open‑multi‑agent from 1.5.0 up to and including 1.21.2 are affected. The vulnerability exists in the core package, specifically the file_write tool and its path‑safety checks. Users running any of these releases on a system where the agent process can be prompted or directed by an attacker should consider themselves at risk.

The CVSS base score is 5.7, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The risk is driven by the agent’s ability to write files anywhere in the file system, provided an attacker can influence the target path via prompt injection. While local access to the workspace or the ability to inject prompts is required, the impact could be significant if the attacker can overwrite executable files or configuration that the agent will later use. With no public exploits known, the likelihood of exploitation remains moderate, but patching is advised. The likely attack vector is a combination of a local or remote attacker who can inject prompts into the agent and place a controlled symlink in the workspace.