Read the docs
TI-2026-34324 Aliases CVE-2026-46695GHSA-g6ww-w5j2-r7x3

BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files

Priority HIGH 82CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directory in rw mode, thereby gaining write access to that directory. This allows malicious code to perform arbitrary write operations on directories that should be read-only. This issue has been patched in version 0.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix Fixed boxlite (boxlite-ai): 0.9.0boxlite (PyPI): 0.9.0+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
boxlite-aiboxlitebefore 0.9.00.9.0Patch availableCNA
—boxlite (PyPI)before 0.9.00.9.0Patch availableGHSA-g6ww-w5j2-r7x3
—@boxlite-ai/boxlite (npm)before 0.9.00.9.0Patch availableGHSA-g6ww-w5j2-r7x3
—github.com/boxlite-ai/boxlite/sdks/go (Go)before 0.9.00.9.0Patch availableGHSA-g6ww-w5j2-r7x3
—boxlite (crates.io)before 0.9.00.9.0Patch availableGHSA-g6ww-w5j2-r7x3
—boxlite-cli (crates.io)before 0.9.00.9.0Patch availableGHSA-g6ww-w5j2-r7x3
  • boxlite Vendorboxlite-ai Affected before 0.9.0 Fixed in 0.9.0 Patch available CNA
  • boxlite (PyPI) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-g6ww-w5j2-r7x3
  • @boxlite-ai/boxlite (npm) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-g6ww-w5j2-r7x3
  • github.com/boxlite-ai/boxlite/sdks/go (Go) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-g6ww-w5j2-r7x3
  • boxlite (crates.io) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-g6ww-w5j2-r7x3
  • boxlite-cli (crates.io) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-g6ww-w5j2-r7x3

Remediation

  • Fix · CNA boxlite (boxlite-ai) Fixed in 0.9.0
  • Fix · GHSA-g6ww-w5j2-r7x3 boxlite (PyPI) Fixed in 0.9.0 Advisory →
  • Fix · GHSA-g6ww-w5j2-r7x3 @boxlite-ai/boxlite (npm) Fixed in 0.9.0 Advisory →
  • Fix · GHSA-g6ww-w5j2-r7x3 github.com/boxlite-ai/boxlite/sdks/go (Go) Fixed in 0.9.0 Advisory →
  • Fix · GHSA-g6ww-w5j2-r7x3 boxlite (crates.io) Fixed in 0.9.0 Advisory →
  • Fix · GHSA-g6ww-w5j2-r7x3 boxlite-cli (crates.io) Fixed in 0.9.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46695
  2. 2026-10-03 Alias added: GHSA-g6ww-w5j2-r7x3

References

Advisory 1

Other 5

  • TI-2026-34332 BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host CVSS 3.1CRITICAL 9.6
  • TI-2026-34801 BoxLite: Timeout Bypass Vulnerability CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences