Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively…
Priority LOW 38CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-269.
Summary
Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-5180.
Why it matters now
EPSS 0.0036 29th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:firejail_project:firejail:*:*:*:*:lts:*:*:* | 0.9.38 – 0.9.38.10 | Vulnerable | Firejail Project |
| cpe:2.3:a:firejail_project:firejail:*:*:*:*:*:*:*:* | 0.9.40 – 0.9.44.6 | Vulnerable | Firejail Project |
- cpe:2.3:a:firejail_project:firejail:*:*:*:*:lts:*:*:* Versions 0.9.38 – 0.9.38.10 Vulnerable ·Firejail Project
- cpe:2.3:a:firejail_project:firejail:*:*:*:*:*:*:*:* Versions 0.9.40 – 0.9.44.6 Vulnerable ·Firejail Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5940
- 2026-10-03 Alias added: GHSA-2mx9-jpq3-jxj6
References
Patch 4
- https://github.com/netblue30/firejail/commit/b8a4ff9775318ca5e679183884a6a63f3da8f863
- https://github.com/netblue30/firejail/commit/38d418505e9ee2d326557e5639e8da49c298858f
- http://www.openwall.com/lists/oss-security/2017/01/31/16
- https://github.com/netblue30/firejail/commit/903fd8a0789ca3cc3c21d84cd0282481515592ef
More Firejail Project Firejail vulnerabilities
- TI-2020-13142 Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or… CVSS 3.1CRITICAL 9.8
- TI-2017-03321 Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows… CVSS 3.0CRITICAL 9.0
- TI-2019-09401 In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a… CVSS 3.0HIGH 8.8
- TI-2019-09334 Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on… CVSS 3.0HIGH 8.1
- TI-2017-03296 Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the… CVSS 3.0HIGH 8.8
- TI-2016-07383 Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox… CVSS 3.0HIGH 8.8
Sources
- CVE-2017-5940 · CVE Program
- CVE-2017-5940 · NVD
- FIRST EPSS
- GHSA-2mx9-jpq3-jxj6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences