Evidence · DiggingBeagle record
mini-swe-agent v2.4.6: BubblewrapEnvironment implementation
Pinned repository implementation inspected as text. BubblewrapEnvironmentConfig.wrapper_args uses read-only binds and --setenv PATH but does not include --clearenv or --unshare-net; execute runs subprocess.run without a supplied env mapping. The environment is marked experimental.
- Publisher
- SWE-agent project
- Source role
- patch commit artifact
Evidence record
Pinned repository implementation inspected as text. BubblewrapEnvironmentConfig.wrapper_args uses read-only binds and --setenv PATH but does not include --clearenv or --unshare-net; execute runs subprocess.run without a supplied env mapping. The environment is marked experimental.
Claim-level citations (3)
- supportsmini-swe-agent Bubblewrap inherited runner environment variables (CVE-2026-108592): The default Bubblewrap wrapper arguments also omit --unshare-net, so the studied sandbox does not establish a separate network namespace; this increases the consequence of a model-directed command reading an inherited secret.
BubblewrapEnvironmentConfig.wrapper_args, pinned v2.4.6 lines 37-67
- supportsmini-swe-agent Bubblewrap inherited runner environment variables (CVE-2026-108592): In the inspected v2.4.6 BubblewrapEnvironment code, default wrapper arguments omit --clearenv and subprocess.run supplies no env mapping; the reporter reproduced inheritance of a nonsecret host marker into the sandboxed shell and its removal when --clearenv was added.
BubblewrapEnvironmentConfig.wrapper_args (file lines 37-67) and BubblewrapEnvironment.execute, subprocess.run call (lines 79-104)
- supportsmini-swe-agent Bubblewrap inherited runner environment variables (CVE-2026-108592): The researcher tested environment inheritance with a synthetic marker, not a complete injected agent run, an actual provider key, or real network exfiltration; BubblewrapEnvironment is described by the project as experimental and optional.
Module header warning: This environment is experimental