mini-swe-agent’s Bubblewrap sandbox inherits sensitive environment variables

What happened

The optional Bubblewrap backend passes the runner’s environment into sandboxed commands. Those commands can read API keys or other secrets present in that environment.

The CVE was published on 10 October; the original researcher publication date is unconfirmed. A secret must be present and the agent must execute a command that reads it. The default Bubblewrap configuration also retains network access. The researcher verified inheritance with a synthetic marker. The CNA gives CVSS 3.1 score 5.3. Patch status remains unconfirmed as of 11 October.