Executive brief
Boxlite is a sandbox service used to run untrusted code within lightweight virtual machines. A security flaw in how it handles container images allows an attacker to bypass the sandbox's isolation. If a user is tricked into loading a specially crafted malicious image (for example, from a public registry like DockerHub), the attacker can write files to any location on the host computer. This can lead to a total system takeover, allowing the attacker to execute commands with the same permissions as the Boxlite service, which often runs with administrative privileges.
Technical details
A path traversal vulnerability exists in Boxlite's OCI layer extraction logic within `boxlite/src/images/archive/tar.rs`. The root cause is a failure to validate symlink targets during the extraction of tar entries. While the symlink's location is sanitized to stay within the destination directory, the target path is not. An attacker can create a symlink pointing to an absolute path on the host (e.g., `/etc`). Subsequent file writes in the tarball that reference the symlink path are followed by the kernel, allowing the attacker to write arbitrary content to the host filesystem. Since the extraction process typically runs with high privileges (often root), this can be leveraged for remote code execution by overwriting sensitive files like `authorized_keys`. The issue is fixed in version 0.9.0 by hardening the OCI image pull and extraction security.
Affected products
- boxlite-ai Boxlite < 0.9.0
Timeline
- 2026-05-03: patched: Version 0.9.0 released fixing the vulnerability.
- 2026-05-16: advisory: GitHub security advisory GHSA-f396-4rp4-7v2j published.
- 2026-06-10: disclosed: CVE-2026-46703 published to the NVD.