# CVE-2026-128079: envd: Host file disclosure through requirements path traversal and TOCTOU

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

envd provides reproducible development environments for humans and agents. In versions starting with 0.3.38 and before 1.3.6, insufficient containment of host-side requirements-file reads in  install.python_packages(requirements=...)  could allow access to files outside the build context. An attacker able to influence build input could cause file contents interpreted as dependency entries to appear in debug logs or build-step metadata, subject to the envd process’s permissions. Exploitation in version 1.3.5 additionally requires concurrent modification of relevant filesystem paths. This issue is fixed in version 1.3.6.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- tensorchord / envd: >= 0.3.38, < 1.3.6 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 4.0: 6.8 (medium); CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-22, CWE-367

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/tensorchord/envd/security/advisories/GHSA-jv6m-48w5-5rpr (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/tensorchord/envd/pull/2112 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/tensorchord/envd/pull/2119 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/tensorchord/envd/commit/9d575b354ce17a02ef9698b6ff0d5d14296c5734 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/tensorchord/envd/commit/f576c92c1e6dcb9b00b60995534aeb2a83b0b407 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/tensorchord/envd/releases/tag/v1.3.6 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-128079; retrieved 2026-11-13; source updated 2026-11-13

Revision: d27003b7e6e2926c3cf793c4eac9594797e81f35b4339d1a0da9da8d67ff7e8a

Canonical: https://y2.dev/cve/CVE-2026-128079

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.