{"data":{"id":"6df38fcf-ce8a-49f5-a01d-a9408c489f63","title":"GHSA-m77w-p5jj-xmhg: OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input","summary":"GHSA-m77w-p5jj-xmhg reports that OpenClaude's BashTool input schema exposes `dangerouslyDisableSandbox` to the model, which the project's own threat model treats as an untrusted principal. In `shouldUseSandbox()` in `src/tools/BashTool/shouldUseSandbox.ts`, that flag skips the sandbox when `areUnsandboxedCommandsAllowed()` returns true, and that check defaults to true in `src/utils/sandbox/sandbox-adapter.ts`. A prompt-injected model can therefore set the flag in a `tool_use` block and run arbitrary host commands under default configuration.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-m77w-p5jj-xmhg","publishedAt":"2026-05-12T16:17:59.000Z","cveId":"CVE-2026-42074","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["openclaude@< 0.5.1 (fixed: 0.5.1)"],"affectedPackageNames":["openclaude"],"affectedPackageRefs":["npm:openclaude"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaude"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00589,"epssCheckedAt":"2026-11-07T06:14:02.898Z","kevDateAdded":null,"advisoryAliases":["GHSA-m77w-p5jj-xmhg"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-12T16:17:59.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-11-06T00:07:45.722Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"openclaude","fixedVersion":"0.5.1","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"registry","status":"version_not_found","checkedAt":"2026-11-06T00:07:45.721Z"}]}}