CVE-2026-108751
MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer
modu-ai moai-adk
CVSS
4.8MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so atomicWriteFile truncates and overwrites victim-writable files with MoAI template content.
Text from CVE List
Affected versions 1
- moai-adkaffected: all versions through 3.1.2CVE List
References 5
- vulncheck.com/advisories/moai-adk-through-3.1.2-symlink-following-via-moai-init-template-deployerAdvisoryvia CVE List
- hackmd.io/@haind/moai-adk-template-staging-symlink-overwriteExploitvia CVE List
- github.com/modu-ai/moai-adk/blob/4b2f203feda9c2cb6d7771969f4ec966842c8732/internal/template/deployer.go#L19-L32Referencevia CVE List
- github.com/modu-ai/moai-adk/blob/4b2f203feda9c2cb6d7771969f4ec966842c8732/internal/template/deployer.go#L160-L203Referencevia CVE List
- github.com/modu-ai/moai-adkReferencevia CVE List