CVE-2026-109569: sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace
sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Deployments using sandboxed.sh through version 1.3.0 are exposed when untrusted or insufficiently trusted code can run in a container workspace. The vulnerable behavior affects agent-run code in those workspaces.
What does an attacker need to exploit it?
An attacker needs the ability to execute code in a container workspace. No user interaction is required, but the attack vector is local and requires low privileges.
What could an attacker do after exploitation?
Code running in the workspace can resolve absolute paths against the host filesystem rather than the intended container root. This can allow reading and modifying host files, with high impacts to confidentiality, integrity, and availability.
How can I determine whether my deployment is affected?
Check whether sandboxed.sh is version 1.3.0 or earlier and whether its workspace execution uses nsenter without the --root option. Also assess whether agents can run code that is not fully trusted in container workspaces.