AIKIDO-2026-891128

TL;DR

The Cline harness file tools (read, write, edit, grep, glob, ls) accept absolute paths and traversal sequences that escape the session working directory, and they follow symlinks that point outside the allowed roots. A model steered through prompt injection can use a file tool with a malicious path to read files belonging to concurrent sessions, including environment variables, credentials, and configuration, and in allow-edits mode can write or change files outside the workspace. The fix normalizes requested paths, uses their real paths, and rejects paths outside the session working directory or explicitly configured readable roots, and recursive searches no longer follow symlinks.