Summary
.install files do not validate whether they are inside the package area, and so can bypass sandboxing.
Exploit
In a package.install file, this installs a file as ~/.bashrc: bin: [ "payload.sh" {"../../../.bashrc"} ]
Timeline
- 2026-04-11: Anil forwarded the issue from Andrew Nesbitt to the OCaml security team - 2026-04-11: Kate developed a fix - 2026-04-15: opam 2.5.1 was released with the fix