BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite allows users to specify the OCI image used by containers in the sandbox. However, when processing tar entries in OCI images, Boxlite does not account for the possibility that entries may be symlinks pointing to absolute paths. An attacker can craft a malicious OCI image and distribute it on image hosting platforms such as DockerHub, tricking users into using it. Once a user loads the malicious image, the attacker can write arbitrary content to any path on the host, which can further lead to remote code execution on the host. This issue has been patched in version 0.9.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| boxlite-ai | boxlite | before 0.9.0 | 0.9.0 | Patch available | CNA |
| — | boxlite (PyPI) | before 0.9.0 | 0.9.0 | Patch available | GHSA-f396-4rp4-7v2j |
| — | boxlite-cli (crates.io) | before 0.9.0 | 0.9.0 | Patch available | GHSA-f396-4rp4-7v2j |
| — | boxlite (crates.io) | before 0.9.0 | 0.9.0 | Patch available | GHSA-f396-4rp4-7v2j |
| — | @boxlite-ai/boxlite (npm) | before 0.9.0 | 0.9.0 | Patch available | GHSA-f396-4rp4-7v2j |
| — | github.com/boxlite-ai/boxlite/sdks/go (Go) | before 0.9.0 | 0.9.0 | Patch available | GHSA-f396-4rp4-7v2j |
- boxlite Vendorboxlite-ai Affected before 0.9.0 Fixed in 0.9.0 Patch available CNA
- boxlite (PyPI) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-f396-4rp4-7v2j
- boxlite-cli (crates.io) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-f396-4rp4-7v2j
- boxlite (crates.io) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-f396-4rp4-7v2j
- @boxlite-ai/boxlite (npm) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-f396-4rp4-7v2j
- github.com/boxlite-ai/boxlite/sdks/go (Go) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-f396-4rp4-7v2j
Remediation
- Fix · CNA boxlite (boxlite-ai) Fixed in 0.9.0
- Fix · GHSA-f396-4rp4-7v2j boxlite (PyPI) Fixed in 0.9.0 Advisory →
- Fix · GHSA-f396-4rp4-7v2j boxlite-cli (crates.io) Fixed in 0.9.0 Advisory →
- Fix · GHSA-f396-4rp4-7v2j boxlite (crates.io) Fixed in 0.9.0 Advisory →
- Fix · GHSA-f396-4rp4-7v2j @boxlite-ai/boxlite (npm) Fixed in 0.9.0 Advisory →
- Fix · GHSA-f396-4rp4-7v2j github.com/boxlite-ai/boxlite/sdks/go (Go) Fixed in 0.9.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46703
- 2026-10-03 Alias added: GHSA-f396-4rp4-7v2j
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More boxlite-ai vulnerabilities
- TI-2026-34324 BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files CVSS 3.1CRITICAL 10.0
- TI-2026-34801 BoxLite: Timeout Bypass Vulnerability CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-46703 · CVE Program
- CVE-2026-46703 · NVD
- FIRST EPSS
- GHSA-f396-4rp4-7v2j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences