CVE-2026-109569

Summary

A container escape vulnerability in sandboxed.sh allows containerized code to access and modify host filesystems by using nsenter without --root flag, bypassing expected isolation boundaries. This creates a high-risk scenario where attackers can read and write arbitrary host files from within containers.

Exploitability

Exploitation is moderately difficult requiring a container workspace with agent-run code that can resolve absolute paths on the host, but the precondition is relatively common in development environments.

Blast radius

The impact could be severe across many systems as attackers can read sensitive host files, modify critical configuration or binaries, and potentially establish persistent access through host-level persistence mechanisms.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to sandboxed.sh version 1.3.1 or later to address the container escape vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.