Critical Container Escape Flaw Found in sandboxed.sh Versions Up to 1.3.0

A critical security vulnerability has been identified in sandboxed.sh, a tool designed to provide isolated container workspaces. The National Vulnerability Database (NVD) has assigned the flaw CVE-2026-109569 and rated it with a CVSS score of 9.3, classifying it as critical. This issue impacts all versions of the software up to and including version 1.3.0, created by developer Th0rgal.

The vulnerability stems from improper configuration of the nsenter utility within the sandboxed.sh environment. Specifically, nsenter attaches to namespaces without using the --root flag. This misconfiguration allows code running inside a container workspace to access the host filesystem directly. According to the NVD record, this bypasses the documented isolation features that are supposed to protect the host system from containerized processes.

Technical Details and Impact

The core of the issue lies in how sandboxed.sh handles namespace transitions. By omitting the --root argument, the tool fails to properly restrict the root directory view for processes entering the container. This weakness is categorized under CWE-1188, which relates to improper handling of security contexts. Agent-run code within the affected container workspace can exploit this gap to resolve absolute paths on the host machine.

Consequently, an attacker who controls code execution within the sandboxed container can read and modify files on the host system. This capability effectively breaks the containment boundary, allowing unauthorized access to sensitive host data. The NVD description notes that this action bypasses the isolation mechanisms that users rely on for security. The ability to modify host files represents a significant escalation of privileges beyond the intended scope of the container.

Affected Versions and Scope

The vulnerability affects Th0rgal’s sandboxed.sh software specifically in versions prior to and including 1.3.0. Any deployment using these versions is potentially exposed to the container escape risk described in the CVE record. The NVD listing does not specify a release date for the patch, nor does it confirm whether a fix has been issued by the vendor. Users of older versions are advised to review their current installations against this version threshold.

The scope of the impact includes any environment where sandboxed.sh is used to isolate workloads. Since the tool is designed to provide security through isolation, the failure of this mechanism undermines its primary purpose. The critical CVSS score reflects the high severity of allowing host filesystem access from a contained environment. No specific threat actors or active exploitation campaigns have been linked to this vulnerability in the available source material.

What should you do?

Organizations should immediately audit their environments to identify any instances of sandboxed.sh running versions 1.3.0 or earlier. Administrators should check if any container workspaces are currently executing untrusted code, as this increases the risk of exploitation. Monitoring host filesystems for unexpected changes or unauthorized access attempts is recommended while a solution is sought. Users should watch for official announcements from Th0rgal regarding a patched version or mitigation guidance.