What happened
Entire CLI before 0.7.7 used unvalidated SessionID from remote checkpoint metadata to build restore paths, enabling path traversal that writes transcript data outside the session directory and can overwrite arbitrary files on the victim's host. CVSS 6.2 (v4.0), published 2026-10-23.
Why it matters
Agent session state is now stored and restored from Git. If that state is attacker-influenced, the restore path becomes a file-write primitive on the developer's machine, which an AI-agent-flow attacker or a malicious contributor could exploit.
Attack vector
The checkpoint metadata is fetched from the remote entire/checkpoints/v1 branch and the SessionID field is used to construct filesystem paths without validation in the restore path (CWE-22), so a malicious SessionID containing absolute paths or traversal sequences overwrites arbitrary files on the victim's machine when a session is resumed or rewound.
Affected systems
Entire CLI before 0.7.7 (checkpoint metadata from the entire/checkpoints/v1 branch)
Mitigation
Upgrade to Entire CLI 0.7.7 (GHSA-2h46-9x5w-4wf7); validate/normalize SessionID and sandbox the checkpoint-restore write target; treat checkpoint metadata as untrusted input from a repo you may not fully control.