Read the docs
TI-2026-71299 Aliases CVE-2026-109569GHSA-xqq7-hjvp-gg2f

Container escape in sandboxed.sh lets workspace code read host files

Priority MEDIUM 41CWE-1188Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

sandboxed.sh through 1.3.0 by Th0rgal contains a container escape because nsenter attaches without --root. Code running in a container workspace, including code run by an agent, can resolve absolute paths on the host to read and modify host files, bypassing documented isolation. The flaw is an insecure default in resource initialization (CWE-1188). An attacker needs local access with low privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00126 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Th0rgalsandboxed.shup to 1.3.0—No fix listedCNA
  • sandboxed.sh VendorTh0rgal Affected up to 1.3.0 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for sandboxed.sh.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109569
  2. 2026-10-13 Alias added: GHSA-xqq7-hjvp-gg2f
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-13 CISA SSVC decision points changed
  5. 2026-10-13 Priority changed: LOW → MEDIUM

References

Patch 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences