CVE-2026-46695 json
BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files
published 2026-05-16 5 mo ago modified 2026-10-12 27 d ago also GHSA-g6ww-w5j2-r7x3 , GO-2026-5392 , PYSEC-2026-299 , RUSTSEC-2026-0147 , EUVD-2026-36166
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directory in rw mode, thereby gaining write access to that directory. This allows malicious code to perform arbitrary write operations on directories that should be read-only. This issue has been patched in version 0.9.0.
Patch / fix
- pypi boxlite 0.9.0
- npm @boxlite-ai/boxlite 0.9.0
- go github.com/boxlite-ai/boxlite/sdks/go 0.9.0
- crates.io boxlite 0.9.0
- crates.io boxlite-cli 0.9.0
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/boxlite-ai/boxlite#454 pull request
- github.com/boxlite-ai/boxlite/releases/tag/v0.9.0 release
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-g6ww-w5j2-r7x3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
| OSV | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
| OSV | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | boxlite | <0.9.0 |
0.9.0 |
| npm | @boxlite-ai/boxlite | <0.9.0 |
0.9.0 |
| go | github.com/boxlite-ai/boxlite/sdks/go | <0.9.0 |
0.9.0 |
| crates.io | boxlite | <0.9.0 >=0.0.0-0, <0.9.0 |
0.9.0 |
| crates.io | boxlite-cli | <0.9.0 |
0.9.0 |
Affected products
- boxlite-ai boxlite
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/boxlite-ai/boxlite/pull/454
web
-
github.com
/boxlite-ai/boxlite/security/advisories/GHSA-g6ww-w5j2-r7x3
exploit, web, advisory
-
github.com
/boxlite-ai/boxlite/releases/tag/v0.9.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-46695
advisory
-
github.com
/boxlite-ai/boxlite
package
-
rustsec.org
/advisories/RUSTSEC-2026-0147.html
web, advisory
-
pypi.org
/project/boxlite
package
-
github.com
/advisories/GHSA-g6ww-w5j2-r7x3
advisory
-
crates.io
/crates/boxlite
package
Sources
- CVE List CVE-2026-46695
- GitHub Advisory GHSA-g6ww-w5j2-r7x3
- NVD CVE-2026-46695
- OSV PYSEC-2026-299
- OSV GO-2026-5392
- OSV RUSTSEC-2026-0147
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.