Is CVE-2026-46695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46695 being exploited in the wild.

How severe is CVE-2026-46695?

Critical severity, with a CVSS score of 10, published 10 June 2026.

Which products and versions are affected?

boxlite (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.9.0; boxlite-cli (crates.io) < 0.9.0; github.com/boxlite-ai/boxlite/sdks/go (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; @boxlite-ai/boxlite (npm) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; and 1 more.

Is there a fix for CVE-2026-46695?

Yes. boxlite (crates.io): upgrade to 0.9.0 or later; github.com/boxlite-ai/boxlite/sdks/go (Go): upgrade to 0.9.0 or later; @boxlite-ai/boxlite (npm): upgrade to 0.9.0 or later; boxlite (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46695 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-46695?

Check whether you run boxlite (crates.io), boxlite-cli (crates.io), github.com/boxlite-ai/boxlite/sdks/go (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46695: boxlite-ai Boxlite read-only volume bypass via CAP_SYS_ADMIN

Q: Is there a fix for CVE-2026-46695?

Yes. boxlite (crates.io): upgrade to 0.9.0 or later; github.com/boxlite-ai/boxlite/sdks/go (Go): upgrade to 0.9.0 or later; @boxlite-ai/boxlite (npm): upgrade to 0.9.0 or later; boxlite (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46695 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-46695?

Check whether you run boxlite (crates.io), boxlite-cli (crates.io), github.com/boxlite-ai/boxlite/sdks/go (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46695 · Severity: critical · CVSS 10 · Published 2026-06-10

Boxlite is a sandbox service used to run untrusted code within lightweight virtual machines, often used in AI agent and development environments. A critical security flaw allowed untrusted code to bypass "read-only" protections on folders shared from the host computer. This means a malicious script could modify sensitive host files, credentials, or configuration data, potentially leading to a full takeover of the host system.

Technologies: boxlite (PyPI). Vendors: crates.io, Go, npm, PyPI.

Quick answers

Is CVE-2026-46695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46695 being exploited in the wild.
How severe is CVE-2026-46695?: Critical severity, with a CVSS score of 10, published 10 June 2026.
Which products and versions are affected?: boxlite (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.9.0; boxlite-cli (crates.io) < 0.9.0; github.com/boxlite-ai/boxlite/sdks/go (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; @boxlite-ai/boxlite (npm) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; and 1 more.
Is there a fix for CVE-2026-46695?: Yes. boxlite (crates.io): upgrade to 0.9.0 or later; github.com/boxlite-ai/boxlite/sdks/go (Go): upgrade to 0.9.0 or later; @boxlite-ai/boxlite (npm): upgrade to 0.9.0 or later; boxlite (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46695 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-46695?: Check whether you run boxlite (crates.io), boxlite-cli (crates.io), github.com/boxlite-ai/boxlite/sdks/go (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

boxlite (crates.io): upgrade to 0.9.0 or later
```
cargo update -p boxlite
```
github.com/boxlite-ai/boxlite/sdks/go (Go): upgrade to 0.9.0 or later
```
go get github.com/boxlite-ai/boxlite/sdks/go@v0.9.0
```
@boxlite-ai/boxlite (npm): upgrade to 0.9.0 or later
```
npm install @boxlite-ai/boxlite@0.9.0
```
boxlite (PyPI): upgrade to 0.9.0 or later
```
pip install "boxlite>=0.9.0"
```

Technical details

Boxlite prior to version 0.9.0 suffers from a sandbox escape vulnerability due to improper access control (CWE-284). The service failed to enforce read-only restrictions at the hypervisor level (virtiofs), instead relying on guest-side mount flags. Compounding this, the OCI spec builder granted containers all 41 kernel capabilities, including CAP_SYS_ADMIN. An attacker running untrusted code within a 'Box' can use these elevated privileges to remount supposedly read-only host volumes as read-write (mount -o remount,rw). This allows for the modification of host files, which can be leveraged for host code execution. The issue is fixed in version 0.9.0 by upgrading libkrun to enforce read-only mounts at the device level and restricting default container capabilities to the standard Docker set.

Affected products

boxlite-ai Boxlite < 0.9.0

Identifiers

CVE-2026-46695
GHSA-g6ww-w5j2-r7x3
GO-2026-5392
PYSEC-2026-299
RUSTSEC-2026-0147

Timeline

2026-04-29: patched: Fix merged in pull request #454
2026-05-03: other: Version 0.9.0 released
2026-05-16: advisory: GitHub security advisory published
2026-06-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.