CVE-2026-86544
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
- Published Sep 7, 2026
- CVSS 7.2 high
- 0.6% chance of exploitation in the next 30 days (EPSS)
- A fix is available