CVE-2026-129130

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-129130

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129130.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-129130

Aliases

GHSA-g87j-p64h-w8wc

Published

2026-11-13T16:23:38Z

Modified

2026-11-15T07:03:33Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

agent-device 0.21.36 Local File Disclosure via file:// Navigation in Open Command

Details

agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remote callers to read daemon-host files by opening file:// URLs. Attackers can send an open command with a file:// target through /rpc, then issue snapshot to read any plaintext file readable by the daemon account.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129130.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "0.21.36"
                        },
                        {
                            "fixed": "0.21.37"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "0.21.36"
                        },
                        {
                            "fixed": "0.21.37"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/callstack/agent-device

Affected ranges

Type

GIT

Repo

https://github.com/callstack/agent-device

Events

Introduced

Fixed

2deb909ec88bbbde615ec7c8f3895ef222d8ab3d

Fixed

d2426fffdf7829f58458ec1631bd117e6cd8cf94

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "2deb909ec88bbbde615ec7c8f3895ef222d8ab3d"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.21.37",
            "range": [
                {
                    "fixed": "d2426fffdf7829f58458ec1631bd117e6cd8cf94"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other

evidence/ios-snapshot/6a03688d80

nightly/v0.*

nightly/v0.21.29-nightly.20261016.72

nightly/v0.21.29-nightly.20261017.73

nightly/v0.21.29-nightly.20261018.74

nightly/v0.21.29-nightly.20261019.75

nightly/v0.21.29-nightly.20261020.76

nightly/v0.21.30-nightly.20261021.78

nightly/v0.21.31-nightly.20261022.80

nightly/v0.21.32-nightly.20261023.83

nightly/v0.21.32-nightly.20261024.84

nightly/v0.21.32-nightly.20261025.85

nightly/v0.21.32-nightly.20261026.96

nightly/v0.21.34-nightly.20261028.102

nightly/v0.21.34-nightly.20261029.105

nightly/v0.21.36-nightly.20261030.114

nightly/v0.21.36-nightly.20261031.115

nightly/v0.21.36-nightly.20261102.118

nightly/v0.21.37-nightly.20261103.128

nightly/v0.21.37-nightly.20261106.150

nightly/v0.21.37-nightly.20261107.151

nightly/v0.21.37-nightly.20261108.152

nightly/v0.21.37-nightly.20261109.153

nightly/v0.21.37-nightly.20261110.154

nightly/v0.21.37-nightly.20261111.161

v0.*

v0.1.8

v0.1.9

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.11.0

v0.11.1

v0.11.10

v0.11.11

v0.11.12

v0.11.14

v0.11.15

v0.11.16

v0.11.2

v0.11.3

v0.11.4

v0.11.5

v0.11.6

v0.11.7

v0.11.8

v0.11.9

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.12.7

v0.12.8

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.14.1

v0.14.2

v0.14.3

v0.14.4

v0.14.5

v0.14.7

v0.14.9

v0.16.10

v0.16.11

v0.16.12

v0.16.13

v0.16.7

v0.16.9

v0.17.0

v0.17.1

v0.17.10

v0.17.2

v0.17.4

v0.17.6

v0.17.7

v0.17.8

v0.17.9

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.19.0

v0.19.1

v0.19.2

v0.19.3

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.20.0

v0.20.10

v0.20.2

v0.20.3

v0.20.4

v0.20.5

v0.20.6

v0.20.7

v0.20.8

v0.20.9

v0.21.10

v0.21.11

v0.21.12

v0.21.13

v0.21.14

v0.21.16

v0.21.17

v0.21.18

v0.21.2

v0.21.21

v0.21.22

v0.21.23

v0.21.24

v0.21.25

v0.21.26

v0.21.27

v0.21.28

v0.21.29

v0.21.3

v0.21.30

v0.21.31

v0.21.32

v0.21.33

v0.21.34

v0.21.35

v0.21.36

v0.21.4

v0.21.5

v0.21.6

v0.21.7

v0.21.8

v0.21.9

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.18

v0.7.19

v0.7.2

v0.7.20

v0.7.21

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.9

v0.8.0

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129130.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "117223114178397687416638132493813206096",
                "39260288044517156364762855572425033505",
                "121555935270399165813277579799051352016",
                "212745967347755187523087231278387037808",
                "145844874551575637890386952732240785662",
                "26525292114877855960546199726104768642",
                "126888347634010430748031512419541923528",
                "336090855759076286065663990618184459943",
                "322324872051835832012597390816434429332",
                "229692825170755600650101914857365741328",
                "137287488094576308614462676099381564233",
                "81172795618809929463723508946961206641",
                "80750398723668273497623401601185609925"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-129130-6ae1bc24",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/callstack/agent-device/commit/d2426fffdf7829f58458ec1631bd117e6cd8cf94",
        "target": {
            "file": "apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/RunnerSimulatorEdgeContact.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "76865987052628179167981622545701878210",
                "278371990447192431395754016907500183447",
                "242825971972600392062270127504360507552",
                "143824791361248070223042454811300263028",
                "247035969921594093326363804111246784960",
                "204888131644766667691016292291565686268"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-129130-a2870b58",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/callstack/agent-device/commit/d2426fffdf7829f58458ec1631bd117e6cd8cf94",
        "target": {
            "file": "apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/UnitTests/RunnerEdgeContactTesting.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "170590360103077831110819686540102187084",
                "49925850212056538602525844834375850731",
                "31128192621963340902049055857419087573",
                "141679594085229854296935896834211193488",
                "222027768256278009065934861136968451202",
                "280599011738876527456006056004954128255",
                "244660114739691240069081415918751705476"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-129130-ee288d00",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/callstack/agent-device/commit/d2426fffdf7829f58458ec1631bd117e6cd8cf94",
        "target": {
            "file": "apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/RunnerSimulatorEdgeTouch.h"
        }
    }
]

vanir_signatures_modified

"2026-11-15T07:03:33Z"