[ CVE-2026-109569 · Published 12 Oct 2026 ]
Vulnerability in Th0rgal sandboxed.sh
CVSS 8.8
EPSS <1%No fix listed yet
[ Description ]Official description
sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.