HaiND: mini-swe-agent Bubblewrap host-environment inheritance

Evidence record

Original technical report by Nguyen Dinh Hai on mini-swe-agent v2.4.6. Describes the missing --clearenv and --unshare-net settings, no subprocess env override, a synthetic-marker reproduction and its --clearenv negative control. Does not show real credential theft or an end-to-end injected agent run.

Read the original source ↗

Claim-level citations (3)

• supportsmini-swe-agent Bubblewrap inherited runner environment variables (CVE-2026-108592): The default Bubblewrap wrapper arguments also omit --unshare-net, so the studied sandbox does not establish a separate network namespace; this increases the consequence of a model-directed command reading an inherited secret.

  Root cause sections 1 and 2; Impact and limits

• supportsmini-swe-agent Bubblewrap inherited runner environment variables (CVE-2026-108592): In the inspected v2.4.6 BubblewrapEnvironment code, default wrapper arguments omit --clearenv and subprocess.run supplies no env mapping; the reporter reproduced inheritance of a nonsecret host marker into the sandboxed shell and its removal when --clearenv was added.

  Verification, synthetic MSWEA_AUDIT_SENTINEL experiment and negative control

• supportsmini-swe-agent Bubblewrap inherited runner environment variables (CVE-2026-108592): The researcher tested environment inheritance with a synthetic marker, not a complete injected agent run, an actual provider key, or real network exfiltration; BubblewrapEnvironment is described by the project as experimental and optional.

  Verification and Impact and limits; explicit statement that no full agent loop or credential theft was tested