Key points
- CVE-2026-109569 is rated Critical with a CVSS score of 9.3 by the National Vulnerability Database.
- The flaw affects sandboxed.sh versions up to and including 1.3.0 created by Th0rgal.
- Attackers can use the nsenter command without the --root flag to escape container boundaries.
The short version
- sandboxed.sh versions through 1.3.0 contain a container escape vulnerability.
- Code running inside a container workspace can access and modify files on the host machine.
- The National Vulnerability Database assigns CVE-2026-109569 a critical severity rating of 9.3.
The details
The National Vulnerability Database lists CVE-2026-109569 as a critical security issue affecting sandboxed.sh. The flaw exists in versions up to 1.3.0, which are maintained by Th0rgal. According to the NVD record, the vulnerability stems from how the script uses the nsenter utility. Specifically, nsenter attaches to the container namespace without including the --root flag. This configuration error breaks the intended isolation between the container and the host system.
Because the isolation is bypassed, code executed within the container workspace can resolve absolute paths on the host filesystem. This allows an attacker to read and modify files directly on the host machine. The NVD description notes that this behavior bypasses the documented isolation features of the tool. The weakness is classified under CWE-1188, which relates to improper container isolation.
The context
Container security relies on strict boundaries to prevent code from affecting the host system. When a tool like sandboxed.sh fails to enforce these boundaries, it creates a direct path for attackers. The use of nsenter is common for debugging or management, but omitting the --root flag in this context removes a critical layer of protection. This allows agent-run code to escape its sandboxed environment entirely.
What should you do?
Developers using sandboxed.sh should immediately check their installed versions. If the version is 1.3.0 or lower, they are affected by this critical vulnerability. Users should review any container workspaces that run untrusted or third-party code. Monitoring host filesystem changes can help detect exploitation attempts. Organizations should treat this as a high-priority issue due to the critical CVSS score.
What to do and how to stay safe: sandboxed.sh
- Audit your environment to identify any installations of sandboxed.sh version 1.3.0 or earlier.
- Review logs for unexpected access to host filesystem paths from containerized processes.
- Restrict the execution of untrusted code within containers that use this tooling.
- Wait for the vendor to release an updated version that addresses the nsenter configuration.
Step-by-step guide: Automatic Software Updates: 8 FAQs on Security and Risk
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of sandboxed.sh are affected by CVE-2026-109569?
Versions up to and including 1.3.0 are affected by this critical container escape vulnerability.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-109569 as critical with a CVSS score of 9.3.
How does the vulnerability allow access to the host filesystem?
The flaw occurs because nsenter attaches without the --root flag, allowing code to bypass isolation and resolve host paths.
