AIKIDO-2026-379746
agent-manifest is vulnerable to Improper Check for Unusual or Exceptional Conditions
31
Low Risk
This Affects:
agent-manifestTL;DR
The verifier can return a valid verdict for a signed full-binding manifest that is missing required structural components. When a nested field such as the model-identity binding is omitted alongside another absent nested field, validation-ordering and compatibility filtering drop the structural error before it is surfaced. The independent full-binding mismatch is masked and the manifest is accepted. The fix corrects the validation ordering so the required-component failure is preserved.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on full-binding manifest verification to reject manifests missing required structural components.
Background info
agent-manifest is vulnerable to Improper Check for Unusual or Exceptional Conditions in versions 0.0.1 - 0.11.2.
How to fix this
Upgrade the agent-manifest library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.