Executive brief
Boxlite is a sandbox service used to run untrusted code within lightweight virtual machines, often used in AI agent and development environments. A critical security flaw allowed untrusted code to bypass "read-only" protections on folders shared from the host computer. This means a malicious script could modify sensitive host files, credentials, or configuration data, potentially leading to a full takeover of the host system.
Technical details
Boxlite prior to version 0.9.0 suffers from a sandbox escape vulnerability due to improper access control (CWE-284). The service failed to enforce read-only restrictions at the hypervisor level (virtiofs), instead relying on guest-side mount flags. Compounding this, the OCI spec builder granted containers all 41 kernel capabilities, including CAP_SYS_ADMIN. An attacker running untrusted code within a 'Box' can use these elevated privileges to remount supposedly read-only host volumes as read-write (mount -o remount,rw). This allows for the modification of host files, which can be leveraged for host code execution. The issue is fixed in version 0.9.0 by upgrading libkrun to enforce read-only mounts at the device level and restricting default container capabilities to the standard Docker set.
Affected products
- boxlite-ai Boxlite < 0.9.0
Timeline
- 2026-04-29: patched: Fix merged in pull request #454
- 2026-05-03: other: Version 0.9.0 released
- 2026-05-16: advisory: GitHub security advisory published
- 2026-06-10: disclosed: CVE published to NVD