What happened
CVE-2026-65698 (CVSS 5.3/6.0, published July 23 2026) documents a classic prompt-injection-to-path-traversal chain in the Void AI coding agent's file tools, allowing silent exfiltration of sensitive host files.
Why it matters
This is a textbook demonstration of the prompt-injection → tool-misuse → credential-exfiltration attack chain endemic to AI coding agents with unconfined filesystem tools; while Void itself is a niche/archived project, the underlying pattern (missing workspace confinement + approval-gate bypass) is broadly applicable to other AI coding agents.
Attack vector
The AI agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) lack workspace confinement in validateURI and bypass the approval gate, so network-adjacent attackers can inject instructions into content the agent processes to make it read arbitrary host files (SSH keys, cloud credentials) via absolute paths or file:// URIs, exfiltrating them through subsequent tool calls.
Affected systems
Void through 1.3.4 (project archived 2026-06-03)
Mitigation
No patch available — project archived; restrict tool scope to workspace folders only and enable approval gates for all file-reading tools if self-maintaining a fork.