Beta9 is vulnerable to a Container Escape via Unvalidated Sandbox File Paths

Summary

Beta9 worker versions below 0.1.756 let a tenant holding a workspace token and one running sandbox escape the container through the sandbox file API. The getHostPathFromContainerPath helper in pkg/worker/container_server.go joins tenant-supplied paths onto worker paths, so traversal segments and absolute symbolic links reach any file on the worker as root, including other tenants' files and the worker pod's Kubernetes service account token, which is bound to cluster-admin in the shipped remote-node manifests.

Mitigation

Fixed in worker 0.1.756, which opens these paths with os.OpenRoot so parent-directory and symlink lookups stay inside the container root or mount source, refuses writes to read-only mounts, and does not write through a symlink swapped in after path resolution.

Related items

• MediumGHSA-j656-3hf2-fvjc: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationSimilar attack · GitHub Advisory Database
• MediumCritical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersSimilar attack · The Hacker News
• LowChainalysis Discloses Data Breach Following AI-Driven CyberattackSimilar attack · SecurityWeek
• CriticalBeta9 is vulnerable to a Build Worker Sandbox Escape via Chroot-only Buildah IsolationSimilar attack · JFrog Security Research (Vulnerabilities)
• CriticalPrefab UI is vulnerable to Remote Code Execution via a Pyodide js Bridge to DenoSimilar attack · JFrog Security Research (Vulnerabilities)