# CVE-2026-46703: boxlite-ai Boxlite path traversal via OCI layer symlink escape

Source: https://junglewise.ai/threats/cve-2026-46703-boxlite-ai-boxlite-path-traversal-via-oci-layer-symlink-escape  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-46703 · Severity: critical · CVSS 9.6 · Published 2026-06-10

Boxlite is a sandbox service used to run untrusted code within lightweight virtual machines. A security flaw in how it handles container images allows an attacker to bypass the sandbox's isolation. If a user is tricked into loading a specially crafted malicious image (for example, from a public registry like DockerHub), the attacker can write files to any location on the host computer. This can lead to a total system takeover, allowing the attacker to execute commands with the same permissions as the Boxlite service, which often runs with administrative privileges.

Technologies: [boxlite (PyPI)](https://junglewise.ai/threats/technologies/boxlite). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Go](https://junglewise.ai/threats/vendors/go), [npm](https://junglewise.ai/threats/vendors/npm), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-46703 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46703 being exploited in the wild.

**How severe is CVE-2026-46703?** Critical severity, with a CVSS score of 9.6, published 10 June 2026.

**Which products and versions are affected?** boxlite (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.9.0; boxlite-cli (crates.io) < 0.9.0; github.com/boxlite-ai/boxlite/sdks/go (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; @boxlite-ai/boxlite (npm) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; and 1 more.

**Is there a fix for CVE-2026-46703?** Yes. boxlite (crates.io): upgrade to 0.9.0 or later; github.com/boxlite-ai/boxlite/sdks/go (Go): upgrade to 0.9.0 or later; @boxlite-ai/boxlite (npm): upgrade to 0.9.0 or later; boxlite (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46703 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-46703?** Check whether you run boxlite (crates.io), boxlite-cli (crates.io), github.com/boxlite-ai/boxlite/sdks/go (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- boxlite (crates.io): upgrade to 0.9.0 or later

  ```sh
  cargo update -p boxlite
  ```

- github.com/boxlite-ai/boxlite/sdks/go (Go): upgrade to 0.9.0 or later

  ```sh
  go get github.com/boxlite-ai/boxlite/sdks/go@v0.9.0
  ```

- @boxlite-ai/boxlite (npm): upgrade to 0.9.0 or later

  ```sh
  npm install @boxlite-ai/boxlite@0.9.0
  ```

- boxlite (PyPI): upgrade to 0.9.0 or later

  ```sh
  pip install "boxlite>=0.9.0"
  ```


## Technical details

A path traversal vulnerability exists in Boxlite's OCI layer extraction logic within `boxlite/src/images/archive/tar.rs`. The root cause is a failure to validate symlink targets during the extraction of tar entries. While the symlink's location is sanitized to stay within the destination directory, the target path is not. An attacker can create a symlink pointing to an absolute path on the host (e.g., `/etc`). Subsequent file writes in the tarball that reference the symlink path are followed by the kernel, allowing the attacker to write arbitrary content to the host filesystem. Since the extraction process typically runs with high privileges (often root), this can be leveraged for remote code execution by overwriting sensitive files like `authorized_keys`. The issue is fixed in version 0.9.0 by hardening the OCI image pull and extraction security.

## Affected products

- boxlite-ai Boxlite < 0.9.0

## Identifiers

- CVE-2026-46703
- GHSA-f396-4rp4-7v2j
- GO-2026-5344
- PYSEC-2026-298
- RUSTSEC-2026-0148

## Timeline

- 2026-05-03: patched: Version 0.9.0 released fixing the vulnerability.
- 2026-05-16: advisory: GitHub security advisory GHSA-f396-4rp4-7v2j published.
- 2026-06-10: disclosed: CVE-2026-46703 published to the NVD.

## References

- [https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0](https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0)
- [https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-f396-4rp4-7v2j](https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-f396-4rp4-7v2j)

## Related threats

- [Boxlite improper resource shutdown via SIGALRM timeout bypass](https://junglewise.ai/threats/cve-2026-47213-boxlite-improper-resource-shutdown-via-sigalrm-timeout-bypass)
- [boxlite-ai Boxlite read-only volume bypass via CAP_SYS_ADMIN](https://junglewise.ai/threats/cve-2026-46695-boxlite-ai-boxlite-read-only-volume-bypass-via-cap-sys-admin)