Is CVE-2026-54727 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54727 being exploited in the wild.

How severe is CVE-2026-54727?

High severity, with a CVSS score of 8.2, published 29 July 2026.

Which products and versions are affected?

proot-distro (PyPI) <= 5.1.5, ECOSYSTEM:introduced=0,fixed=5.1.6.

Is there a fix for CVE-2026-54727?

Yes. proot-distro (PyPI): upgrade to 5.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54727 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-54727?

Check whether you run proot-distro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54727: Termux proot-distro container isolation bypass in restore command

Q: Which products and versions are affected?

proot-distro (PyPI) <= 5.1.5, ECOSYSTEM:introduced=0,fixed=5.1.6.

Q: Is there a fix for CVE-2026-54727?

Yes. proot-distro (PyPI): upgrade to 5.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54727 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-54727?

Check whether you run proot-distro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54727 · Severity: high · CVSS 8.2 · Published 2026-07-29

proot-distro is a utility used to manage and run Linux distributions within the Termux environment on Android. A security flaw in the backup restoration process allows a specially crafted archive to bypass the isolation between different installed containers. If a user is tricked into restoring a malicious backup file, an attacker could steal sensitive data (such as SSH keys or credentials) from other containers or inject malicious files into them, potentially compromising the integrity of the user's entire container environment.

Technologies: proot-distro (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54727 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54727 being exploited in the wild.
How severe is CVE-2026-54727?: High severity, with a CVSS score of 8.2, published 29 July 2026.
Which products and versions are affected?: proot-distro (PyPI) <= 5.1.5, ECOSYSTEM:introduced=0,fixed=5.1.6.
Is there a fix for CVE-2026-54727?: Yes. proot-distro (PyPI): upgrade to 5.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54727 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-54727?: Check whether you run proot-distro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

proot-distro (PyPI): upgrade to 5.1.6 or later
```
pip install "proot-distro>=5.1.6"
```

Technical details

A container isolation bypass exists in proot-distro's 'restore' command due to improper validation of hardlink entries within backup archives. While the utility implements path traversal protections to keep operations within the containers directory, it fails to verify that a hardlink's source container matches the destination container being restored. An attacker can craft a TAR archive containing hardlink entries where the 'linkname' references the root filesystem of a different installed container. When a user restores this archive, the utility will copy files from the targeted 'victim' container into the 'attacker' container (disclosure) or vice versa (injection). This vulnerability is classified under CWE-668 and was addressed in version 5.1.6 by ensuring hardlink sources are restricted to the container currently being processed.

Affected products

termux proot-distro < 5.1.6

Identifiers

CVE-2026-54727
GHSA-7h3g-4w2f-fj2f
PYSEC-2026-3607

Timeline

2026-06-09: patched: Version 5.1.6 released
2026-06-10: advisory: GitHub Security Advisory published
2026-07-29: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.