{"id":"CVE-2026-129130","summary":"agent-device 0.21.36 Local File Disclosure via file:// Navigation in Open Command","details":"agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remote callers to read daemon-host files by opening file:// URLs. Attackers can send an open command with a file:// target through /rpc, then issue snapshot to read any plaintext file readable by the daemon account.","aliases":["GHSA-g87j-p64h-w8wc"],"modified":"2026-11-15T07:03:33.484368217Z","published":"2026-11-13T16:23:38.119Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129130.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.21.36"},{"fixed":"0.21.37"}]}]},{"extracted_events":[{"range":[{"introduced":"0.21.36"},{"fixed":"0.21.37"}],"source":"DESCRIPTION"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129130.json"},{"type":"ADVISORY","url":"https://github.com/callstack/agent-device/releases/tag/v0.21.37"},{"type":"ADVISORY","url":"https://github.com/callstack/agent-device/security/advisories/GHSA-g87j-p64h-w8wc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129130"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/agent-device-0.21.36-local-file-disclosure-via-file-navigation-in-open-command"},{"type":"FIX","url":"https://github.com/callstack/agent-device/commit/2deb909ec88bbbde615ec7c8f3895ef222d8ab3d"},{"type":"ARTICLE","url":"https://github.com/callstack/agent-device/blob/ebbaff9a6be75babdb4adcb9074d7522a2773330/packages/daemon/src/server/remote-host-input-policy.ts#L67"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/callstack/agent-device","events":[{"introduced":"0"},{"fixed":"2deb909ec88bbbde615ec7c8f3895ef222d8ab3d"},{"fixed":"d2426fffdf7829f58458ec1631bd117e6cd8cf94"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"2deb909ec88bbbde615ec7c8f3895ef222d8ab3d"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v0.21.37","range":[{"fixed":"d2426fffdf7829f58458ec1631bd117e6cd8cf94"}],"source":"REFERENCES_TAG"}]}}],"versions":["nightly/v0.21.37-nightly.20261111.161","nightly/v0.21.37-nightly.20261110.154","nightly/v0.21.37-nightly.20261109.153","nightly/v0.21.37-nightly.20261108.152","nightly/v0.21.37-nightly.20261107.151","nightly/v0.21.37-nightly.20261106.150","nightly/v0.21.37-nightly.20261103.128","v0.21.36","nightly/v0.21.36-nightly.20261102.118","nightly/v0.21.36-nightly.20261031.115","nightly/v0.21.36-nightly.20261030.114","v0.21.35","v0.21.34","nightly/v0.21.34-nightly.20261029.105","nightly/v0.21.34-nightly.20261028.102","v0.21.33","v0.21.32","nightly/v0.21.32-nightly.20261026.96","nightly/v0.21.32-nightly.20261025.85","nightly/v0.21.32-nightly.20261024.84","nightly/v0.21.32-nightly.20261023.83","v0.21.31","nightly/v0.21.31-nightly.20261022.80","v0.21.30","nightly/v0.21.30-nightly.20261021.78","v0.21.29","nightly/v0.21.29-nightly.20261020.76","nightly/v0.21.29-nightly.20261019.75","nightly/v0.21.29-nightly.20261018.74","nightly/v0.21.29-nightly.20261017.73","nightly/v0.21.29-nightly.20261016.72","v0.21.28","v0.21.27","v0.21.26","v0.21.25","v0.21.24","v0.21.23","v0.21.22","v0.21.21","v0.21.18","v0.21.17","v0.21.16","v0.21.14","v0.21.13","v0.21.12","v0.21.11","v0.21.10","v0.21.9","v0.21.8","v0.21.7","v0.21.6","v0.21.5","v0.21.4","v0.21.3","v0.21.2","evidence/ios-snapshot/6a03688d80","v0.20.10","v0.20.9","v0.20.8","v0.20.7","v0.20.6","v0.20.5","v0.20.4","v0.20.3","v0.20.2","v0.20.0","v0.19.3","v0.19.2","v0.19.1","v0.19.0","v0.18.3","v0.18.2","v0.18.1","v0.18.0","v0.17.10","v0.17.9","v0.17.8","v0.17.7","v0.17.6","v0.17.4","v0.17.2","v0.17.1","v0.17.0","v0.16.13","v0.16.12","v0.16.11","v0.16.10","v0.16.9","v0.16.7","v0.14.9","v0.14.7","v0.14.5","v0.14.4","v0.14.3","v0.14.2","v0.14.1","v0.14.0","v0.13.3","v0.13.2","v0.13.1","v0.12.8","v0.12.7","v0.12.6","v0.12.5","v0.12.4","v0.12.3","v0.12.2","v0.12.1","v0.12.0","v0.11.16","v0.11.15","v0.11.14","v0.11.12","v0.11.11","v0.11.10","v0.11.9","v0.11.8","v0.11.7","v0.11.6","v0.11.5","v0.11.4","v0.11.3","v0.11.2","v0.11.1","v0.11.0","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.0","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.0","v0.7.21","v0.7.20","v0.7.19","v0.7.18","v0.7.17","v0.7.16","v0.7.15","v0.7.14","v0.7.13","v0.7.12","v0.7.11","v0.7.10","v0.7.9","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.4.2","v0.4.1","v0.4.0","v0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.6","v0.2.5","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.9","v0.1.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129130.json","vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["117223114178397687416638132493813206096","39260288044517156364762855572425033505","121555935270399165813277579799051352016","212745967347755187523087231278387037808","145844874551575637890386952732240785662","26525292114877855960546199726104768642","126888347634010430748031512419541923528","336090855759076286065663990618184459943","322324872051835832012597390816434429332","229692825170755600650101914857365741328","137287488094576308614462676099381564233","81172795618809929463723508946961206641","80750398723668273497623401601185609925"]},"id":"CVE-2026-129130-6ae1bc24","signature_type":"Line","signature_version":"v1","source":"https://github.com/callstack/agent-device/commit/d2426fffdf7829f58458ec1631bd117e6cd8cf94","target":{"file":"apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/RunnerSimulatorEdgeContact.h"}},{"source":"https://github.com/callstack/agent-device/commit/d2426fffdf7829f58458ec1631bd117e6cd8cf94","target":{"file":"apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/UnitTests/RunnerEdgeContactTesting.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["76865987052628179167981622545701878210","278371990447192431395754016907500183447","242825971972600392062270127504360507552","143824791361248070223042454811300263028","247035969921594093326363804111246784960","204888131644766667691016292291565686268"]},"id":"CVE-2026-129130-a2870b58","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["170590360103077831110819686540102187084","49925850212056538602525844834375850731","31128192621963340902049055857419087573","141679594085229854296935896834211193488","222027768256278009065934861136968451202","280599011738876527456006056004954128255","244660114739691240069081415918751705476"]},"id":"CVE-2026-129130-ee288d00","signature_type":"Line","signature_version":"v1","source":"https://github.com/callstack/agent-device/commit/d2426fffdf7829f58458ec1631bd117e6cd8cf94","target":{"file":"apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/RunnerSimulatorEdgeTouch.h"}}],"vanir_signatures_modified":"2026-11-15T07:03:33Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}