# CVE-2026-46695: boxlite-ai Boxlite read-only volume bypass via CAP_SYS_ADMIN

Source: https://junglewise.ai/threats/cve-2026-46695-boxlite-ai-boxlite-read-only-volume-bypass-via-cap-sys-admin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-46695 · Severity: critical · CVSS 10 · Published 2026-06-10

Boxlite is a sandbox service used to run untrusted code within lightweight virtual machines, often used in AI agent and development environments. A critical security flaw allowed untrusted code to bypass "read-only" protections on folders shared from the host computer. This means a malicious script could modify sensitive host files, credentials, or configuration data, potentially leading to a full takeover of the host system.

Technologies: [boxlite (PyPI)](https://junglewise.ai/threats/technologies/boxlite). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Go](https://junglewise.ai/threats/vendors/go), [npm](https://junglewise.ai/threats/vendors/npm), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-46695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46695 being exploited in the wild.

**How severe is CVE-2026-46695?** Critical severity, with a CVSS score of 10, published 10 June 2026.

**Which products and versions are affected?** boxlite (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.9.0; boxlite-cli (crates.io) < 0.9.0; github.com/boxlite-ai/boxlite/sdks/go (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; @boxlite-ai/boxlite (npm) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; and 1 more.

**Is there a fix for CVE-2026-46695?** Yes. boxlite (crates.io): upgrade to 0.9.0 or later; github.com/boxlite-ai/boxlite/sdks/go (Go): upgrade to 0.9.0 or later; @boxlite-ai/boxlite (npm): upgrade to 0.9.0 or later; boxlite (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46695 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-46695?** Check whether you run boxlite (crates.io), boxlite-cli (crates.io), github.com/boxlite-ai/boxlite/sdks/go (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- boxlite (crates.io): upgrade to 0.9.0 or later

  ```sh
  cargo update -p boxlite
  ```

- github.com/boxlite-ai/boxlite/sdks/go (Go): upgrade to 0.9.0 or later

  ```sh
  go get github.com/boxlite-ai/boxlite/sdks/go@v0.9.0
  ```

- @boxlite-ai/boxlite (npm): upgrade to 0.9.0 or later

  ```sh
  npm install @boxlite-ai/boxlite@0.9.0
  ```

- boxlite (PyPI): upgrade to 0.9.0 or later

  ```sh
  pip install "boxlite>=0.9.0"
  ```


## Technical details

Boxlite prior to version 0.9.0 suffers from a sandbox escape vulnerability due to improper access control (CWE-284). The service failed to enforce read-only restrictions at the hypervisor level (virtiofs), instead relying on guest-side mount flags. Compounding this, the OCI spec builder granted containers all 41 kernel capabilities, including CAP_SYS_ADMIN. An attacker running untrusted code within a 'Box' can use these elevated privileges to remount supposedly read-only host volumes as read-write (mount -o remount,rw). This allows for the modification of host files, which can be leveraged for host code execution. The issue is fixed in version 0.9.0 by upgrading libkrun to enforce read-only mounts at the device level and restricting default container capabilities to the standard Docker set.

## Affected products

- boxlite-ai Boxlite < 0.9.0

## Identifiers

- CVE-2026-46695
- GHSA-g6ww-w5j2-r7x3
- GO-2026-5392
- PYSEC-2026-299
- RUSTSEC-2026-0147

## Timeline

- 2026-04-29: patched: Fix merged in pull request #454
- 2026-05-03: other: Version 0.9.0 released
- 2026-05-16: advisory: GitHub security advisory published
- 2026-06-10: disclosed: CVE published to NVD

## References

- [https://github.com/boxlite-ai/boxlite/pull/454](https://github.com/boxlite-ai/boxlite/pull/454)
- [https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0](https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0)
- [https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-g6ww-w5j2-r7x3](https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-g6ww-w5j2-r7x3)

## Related threats

- [Boxlite improper resource shutdown via SIGALRM timeout bypass](https://junglewise.ai/threats/cve-2026-47213-boxlite-improper-resource-shutdown-via-sigalrm-timeout-bypass)
- [boxlite-ai Boxlite path traversal via OCI layer symlink escape](https://junglewise.ai/threats/cve-2026-46703-boxlite-ai-boxlite-path-traversal-via-oci-layer-symlink-escape)