CVE-2026-109569

Received Received - Intake

Container Escape via nsenter in sandboxed.sh

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109569

Affected Vendors & Products

Vendor	Product	Version / Range
Th0rgal	sandboxed.sh	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

Executive Summary

sandboxed.sh through version 1.3.0 has a container escape vulnerability. It allows code running inside container workspaces to access the host filesystem because nsenter attaches without the --root flag. This means malicious code can read or modify host files by resolving absolute paths, bypassing the intended isolation.

Detection Guidance

To detect this vulnerability, check if sandboxed.sh version 1.3.0 or earlier is installed. Verify if container workspaces can access host filesystem paths. Inspect nsenter usage in container setups to ensure --root is not missing during attachment.

Impact Analysis

If you use sandboxed.sh, an attacker with access to a container workspace could escape the container and access sensitive files on your host system. This could lead to data theft, unauthorized modifications, or further compromise of your system.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict data isolation and protection, such as GDPR's data processing principles or HIPAA's security rules. Unauthorized host filesystem access may result in data breaches, leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade sandboxed.sh to a version that fixes the container escape issue. Ensure nsenter commands include the --root flag to prevent host filesystem access. Review container configurations to enforce proper isolation boundaries.

Hi! I’m here to help you understand CVE-2026-109569. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70