GHSA-m77w-p5jj-xmhg: OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

Summary

GHSA-m77w-p5jj-xmhg reports that OpenClaude's BashTool input schema exposes `dangerouslyDisableSandbox` to the model, which the project's own threat model treats as an untrusted principal. In `shouldUseSandbox()` in `src/tools/BashTool/shouldUseSandbox.ts`, that flag skips the sandbox when `areUnsandboxedCommandsAllowed()` returns true, and that check defaults to true in `src/utils/sandbox/sandbox-adapter.ts`. A prompt-injected model can therefore set the flag in a `tool_use` block and run arbitrary host commands under default configuration.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
• InfoDecision Models as Retrieval Gates Against Injection and PollutionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMultimodal-SEA: Benchmarking AI Agent Security under Multimodal Social Engineering AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumResearchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User InteractionSimilar attack · The Hacker News