Loading story…
Two critical vulnerabilities in boxlite allow attackers to break isolation guarantees and write to the host filesystem. The first flaw, tracked as CVE-2026-46703 and RUSTSEC-2026-0148, affects OCI image layer extraction: a crafted image can abuse symlink handling in tarball extraction to escape the intended rootfs directory and perform arbitrary host file writes. GitHub’s advisory says the bug can be triggered by malicious OCI images that place symlinks pointing outside the extraction root, causing later files to be written to locations such as /etc or /tmp; if Boxlite runs as root, the issue could lead to remote code execution on the host.
A second critical issue, CVE-2026-46695 and RUSTSEC-2026-0147, lets code inside a boxlite sandbox remount a shared virtiofs host directory from read-only to read-write because the guest retained CAP_SYS_ADMIN while relying on MS_RDONLY. That bypass undermined Boxlite’s advertised read-only isolation and enabled writes back to the host from within the guest. Both flaws were fixed in boxlite 0.9.0: the extraction bug was addressed by routing filesystem operations through a SafeRoot handle using openat2 with RESOLVE_IN_ROOT on Linux, while the remount bypass was mitigated by enforcing read-only access at the hypervisor layer and removing CAP_SYS_ADMIN from the default guest capability set.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The symlink escape vulnerability in boxlite's OCI extraction process was formally issued as CVE-2026-46703. The CVE assignment followed the initial report and public disclosure of the arbitrary host write issue.
Boxlite released version 0.9.0 to address both critical flaws. The update enforced read-only virtiofs access at the hypervisor level and removed CAP_SYS_ADMIN from the default guest capability set, while also routing destructive filesystem operations through a SafeRoot handle using openat2 with RESOLVE_IN_ROOT on Linux and a lexical fallback on other platforms.
Security advisories published for boxlite disclosed two critical vulnerabilities: CVE-2026-46695, which let sandboxed code remount a read-only virtiofs share as writable due to retained CAP_SYS_ADMIN, and CVE-2026-46703, which enabled arbitrary host file writes via OCI layer symlink escape during image extraction. Both issues were described as enabling host filesystem compromise from untrusted workloads or images.
A critical path traversal flaw in boxlite's OCI layer extraction logic was reported, allowing crafted symlink and file entries to escape the intended rootfs and write arbitrary files to the host filesystem. The issue was later tracked as CVE-2026-46703 and credited to the XlabAI Team of Tencent Xuanwu Lab and the Atuin Automated Vulnerability Discovery Engine.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
rustsec.org
Open sourcerustsec.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A vulnerability in **Docker Sandboxes** allowed code running inside a sandbox to bypass a read-only mount and modify host files through an alternate writable path, creating a path for tampering with source code, CI configuration, infrastructure-as-code, and other build inputs that could later execute on the host or in CI pipelines. The flaw, tracked as **`CVE-2026-18171`** with a **CVSS 5.7** score, affected versions **`0.35.0` through `0.38.0`** across **macOS, Linux, and Windows**. The issue stemmed from the same host directory being exposed twice: as a read-only **VirtioFS** mount at a user-specified path and as a writable Docker host export under **`/mnt/host`**. Researchers demonstrated exploitation on **Windows 11** using PowerShell, showing that a compromised coding agent or attacker-controlled code inside the sandbox could write to files that users expected to be protected. Docker reproduced the behavior, fixed the vulnerability, and released a patch on **August 12, 2026**.
Aug 13, 2026
A public disclosure detailed eight **OpenZFS on Linux** vulnerabilities, tracked as `OZ-1` through `OZ-8`, that weaken authorization checks and expose multiple import-time parser bugs. The report says pool-control ioctls improperly trust namespace-local `CAP_SYS_ADMIN` from unprivileged user namespaces and containers when `/dev/zfs` is accessible, allowing host pool operations from confined environments. Reported parser flaws include out-of-bounds reads and writes, a controlled heap overflow, a stack overflow, unbounded traversal, and a cache-destroy hang; `OZ-4` was demonstrated as both a container-to-host-root exploit in a research VM and a reliable host-kernel denial-of-service path via malicious OCI images on **TrueNAS SCALE** and **IncusOS**. Testing cited in the disclosure covered **IncusOS, TrueNAS SCALE, Proxmox VE, and Unraid**, while noting that a tested **RHEL 10.2** configuration with **OpenZFS 2.2.10** plus **SELinux/STIG/FIPS** blocked `OZ-1` and `OZ-2`. The report said all OZ findings remained unfixed in upstream master as of `2026-07-24`, except for `OZ-7`, which had an open contested pull request. Separately, Linux kernel documentation notes that kernel CVE assignment is conservative, generally tied to fixes already merged into supported stable trees, and excludes unsupported versions and distribution-specific issues, leaving downstream vendors and users to determine applicability and prioritize full released updates over cherry-picking individual fixes.
Aug 17, 2026
A newly disclosed KVM/x86 vulnerability, **CVE-2026-64561** or **Zapscape**, allows a privileged L1 guest to break nested virtualization isolation and achieve guest-to-host escape on Linux systems. The bug is a use-after-free in KVM/x86 shadow MMU emulation tied to the recursive shadow-page zap path and stale-root check ordering during guest-triggered page fault handling, enabling corruption of host kernel shadow pages and potential host code execution. Researcher **Hyunwoo Kim** reported the flaw to the Linux kernel security team and published a proof-of-concept showing creation of a root-owned file on the host. The issue affects both **Intel** and **AMD** hosts and is especially serious for environments that run untrusted guests with nested virtualization enabled, including multi-tenant public cloud infrastructure. On Intel, exploitation requires exposing both EPT page walk lengths 4 and 5 to the L1 guest, while no equivalent constraint was noted for AMD. The vulnerability affects Linux KVM versions from **5.9 onward** across the disclosed commit range, and a fix has been merged upstream into mainline Linux, with users advised to deploy patched stable kernels or vendor-backported updates; no in-the-wild exploitation has been claimed.
Aug 7, 2026