Key points
- NVD rates CVE-2026-109569 as Critical with a CVSS score of 9.3.
- The flaw affects Th0rgal’s sandboxed.sh through version 1.3.0.
- Attackers can read and modify host files by resolving absolute paths.
The National Vulnerability Database has published a critical security advisory for sandboxed.sh, a tool used to create isolated container workspaces. The flaw, identified as CVE-2026-109569, carries a CVSS score of 9.3. This rating reflects the potential for significant compromise of the host system from within a supposedly contained environment. System administrators should treat this finding as an urgent matter requiring immediate inventory checks.
The vulnerability exists in all versions of sandboxed.sh up to and including 1.3.0. The software is maintained by Th0rgal. According to the NVD record, the issue stems from how the tool manages namespace entry. Specifically, the script uses the nsenter utility to attach to namespaces without specifying the --root flag. This configuration error breaks the intended boundary between the container and the underlying host operating system.
How it unfolded
- The NVD published CVE-2026-109569 with a CVSS base score of 9.3.
- The advisory identifies CWE-1188 as the underlying weakness category.
- The flaw was found in sandboxed.sh versions through 1.3.0.
The technical root cause is a misconfiguration in the nsenter command execution. When sandboxed.sh initializes a workspace, it relies on nsenter to join specific Linux namespaces. By omitting the --root argument, the process retains access to the host’s root filesystem. This oversight allows code executing inside the container workspace to access the host filesystem. The NVD description notes that this bypasses the documented isolation features of the tool.
Who is affected
Any organization or individual using Th0rgal’s sandboxed.sh at version 1.3.0 or earlier is exposed to this risk. The vulnerability affects the core isolation mechanism, meaning that agent-run code in a container workspace can resolve absolute paths on the host. This includes automated scripts or manual commands executed within the container. The impact allows attackers to read and modify host files.
The weakness is classified under CWE-1188. This categorization is listed in the NVD record for CVE-2026-109569. Because the flaw allows resolution of absolute paths on the host, an attacker can read and modify host files. This capability bypasses the documented isolation of the sandboxed.sh tool.
What happens next
No vendor patch or updated version has been confirmed in the source material. System administrators must verify their current installations against the affected version range. If version 1.3.0 or earlier is in use, the isolation guarantees provided by sandboxed.sh cannot be trusted. Organizations should consider restricting the execution of untrusted code within these environments until a fix is available. Monitoring for unusual file access patterns may help detect exploitation attempts.
The absence of a confirmed fix means that mitigation relies on operational controls. Users should audit their CI/CD pipelines and development environments for instances of sandboxed.sh. If the tool is essential for current workflows, limiting the privileges of the user account running the script can reduce the blast radius. However, this does not eliminate the ability to escape the container namespace.
What to do and how to stay safe: sandboxed.sh
- Audit all systems for installations of sandboxed.sh version 1.3.0 or earlier.
- Restrict execution of untrusted code in environments using this tool.
- Monitor host filesystems for unexpected read or write operations.
- Await a vendor update before restoring full trust in container isolation.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109569?
The NVD assigns a CVSS score of 9.3, which is rated as Critical.
Which versions of sandboxed.sh are affected?
All versions of Th0rgal’s sandboxed.sh up to and including 1.3.0 are affected.
How does the vulnerability allow host access?
The nsenter command attaches without the --root flag, allowing resolution of host absolute paths.
