TI-2026-34719 Aliases CVE-2026-47128 GHSA-27vp-2mmc-vmh3

nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

MEDIUM 60CWE-863Published 2026-07-20 · Updated 2026-07-21

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00125 2nd percentileScored 2026-11-07

Fix Fixed nono (always-further): 0.55.0nono-cli (crates.io): 0.55.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
always-further	nono	before 0.55.0	0.55.0	Patch available	CNA
—	nono-cli (crates.io)	before 0.55.0	0.55.0	Patch available	GHSA-27vp-2mmc-vmh3

nono Vendoralways-further Affected before 0.55.0 Fixed in 0.55.0 Patch available CNA
nono-cli (crates.io) Vendor— Affected before 0.55.0 Fixed in 0.55.0 Patch available GHSA-27vp-2mmc-vmh3

Remediation

Fix · CNA nono (always-further) Fixed in 0.55.0
Fix · GHSA-27vp-2mmc-vmh3 nono-cli (crates.io) Fixed in 0.55.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-47128
2026-10-03 Alias added: GHSA-27vp-2mmc-vmh3

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences