Loading story…
A high-severity remote code execution flaw, CVE-2026-29514, affects NetBox 4.3.5 through 4.5.4 and allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary commands on the server. The bug lies in RenderTemplateMixin.get_environment_params(), where user-controlled JSON in environment_params can supply importable Python callables for Jinja2 settings such as finalize. By resolving values like subprocess.getoutput without an allowlist, NetBox lets attackers turn otherwise harmless template expressions into shell command execution as the NetBox service user.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
A public CVE entry for CVE-2026-29514 described the affected versions, exploitation requirements, and the RenderTemplateMixin.get_environment_params() root cause. The record also linked to the blog post, GitHub issue, pull request, and VulnCheck advisory.
After receiving no maintainer response, the researcher publicly disclosed details of the NetBox vulnerability, including exploitation via the finalize parameter and impact on ExportTemplate and ConfigTemplate. The disclosure described how Jinja2 sandbox protections could be bypassed to execute shell commands as the NetBox service user.
The vulnerability was assigned identifier CVE-2026-29514 through VulnCheck. The CVE covers a high-severity remote code execution issue in NetBox's RenderTemplateMixin handling of environment_params.
The researcher reported the NetBox Jinja2 sandbox bypass and remote code execution issue to the project maintainers. The flaw affected NetBox versions 4.3.5 through 4.5.4 and allowed authenticated low-privilege users with relevant template permissions to achieve code execution.
In July 2025, a NetBox code change added Django import_string() resolution for the Jinja2 environment_params fields undefined and finalize without an allowlist. This created the condition that later enabled sandbox bypass and remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcechocapikk.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical remote code execution** issue in the *n8n* open-source workflow automation platform, tracked as **CVE-2026-25049** (also published as **GHSA-6cqr-8cfr-67f8**), allows an **authenticated** user with permission to create or modify workflows to escape n8n’s expression sandbox and execute arbitrary system commands on the underlying host. The flaw stems from **insufficient input sanitization/weak sandboxing** in n8n’s expression evaluation (server-side JavaScript) and was identified during follow-up analysis after an earlier critical n8n vulnerability (**CVE-2025-68613**) was patched; researchers report the new issue effectively **bypasses prior mitigations**. Reporting indicates exploitation can lead to **full compromise** of the n8n instance, including access to the filesystem and the ability to **steal stored credentials and secrets** (e.g., API keys, OAuth tokens) and sensitive configuration, with potential for **pivoting** into connected internal services and cloud accounts in multi-tenant deployments. Public reporting also notes **public exploits** are available. n8n maintainers state the issue is patched, and affected organizations should upgrade to fixed releases (**1.123.17** and **2.5.2**), as versions **prior to 1.123.17 and 2.5.2** are impacted.
Jun 29, 2026
JFrog researchers disclosed two vulnerabilities in the *n8n* workflow automation platform that allow an **authenticated** attacker to escape built-in sandboxes and achieve **remote code execution (RCE)** on the main n8n node, potentially leading to full instance compromise and access to sensitive connected systems (e.g., APIs, credentials, and internal tooling). The issues are tracked as **CVE-2026-1470** (CVSS **9.9**) and **CVE-2026-0863** (CVSS **8.5**); exploitation is possible even in configurations where n8n runs in “internal” execution mode, which n8n documentation already warns is risky for production due to weaker isolation between the application and task runner processes. Technical details indicate both flaws are sandbox escapes driven by language/runtime edge cases: **CVE-2026-1470** abuses JavaScript expression sandboxing (including `with`-statement handling) to resolve a constructor path to `Function` and execute arbitrary JavaScript, while **CVE-2026-0863** escapes the Python task executor sandbox via Python introspection and runtime behavior (notably Python 3.10+ `AttributeError.obj`) to regain access to restricted builtins/imports and execute OS commands. Recommended remediation is to upgrade n8n to fixed versions (for **CVE-2026-1470**: `1.123.17`, `2.4.5`, or `2.5.1`; for **CVE-2026-0863**: `1.123.14`, `2.3.5`, or `2.4.2`).
Jun 29, 2026
Two critical vulnerabilities in **boxlite** allow attackers to break isolation guarantees and write to the host filesystem. The first flaw, tracked as **CVE-2026-46703** and **RUSTSEC-2026-0148**, affects OCI image layer extraction: a crafted image can abuse symlink handling in tarball extraction to escape the intended `rootfs` directory and perform arbitrary host file writes. GitHub’s advisory says the bug can be triggered by malicious OCI images that place symlinks pointing outside the extraction root, causing later files to be written to locations such as `/etc` or `/tmp`; if Boxlite runs as root, the issue could lead to remote code execution on the host. A second critical issue, **CVE-2026-46695** and **RUSTSEC-2026-0147**, lets code inside a boxlite sandbox remount a shared **virtiofs** host directory from read-only to read-write because the guest retained `CAP_SYS_ADMIN` while relying on `MS_RDONLY`. That bypass undermined Boxlite’s advertised read-only isolation and enabled writes back to the host from within the guest. Both flaws were fixed in **boxlite 0.9.0**: the extraction bug was addressed by routing filesystem operations through a **SafeRoot** handle using `openat2` with `RESOLVE_IN_ROOT` on Linux, while the remount bypass was mitigated by enforcing read-only access at the hypervisor layer and removing `CAP_SYS_ADMIN` from the default guest capability set.
Jun 29, 2026