GHSA-27vp-2mmc-vmh3: nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`
Summary
A sandbox escape vulnerability in nono (a sandboxing tool using Landlock/seccomp, which are Linux security features that restrict what programs can do) allows processes running inside the sandbox to break out by communicating with systemd D-Bus sockets (the inter-process communication system that manages user services). An AI agent or untrusted tool with bash access could exploit this to write files or run commands outside the sandbox with the user's permissions.
Solution / Mitigation
The source states: 'Support for restricting this behavior has since been added and the fix is available in the repository pending release.' However, no specific version number, patch details, or explicit mitigation steps are provided in the text.
Vulnerability Details
EPSS: 0.0%
Yes
May 28, 2026
Classification
Taxonomy References
Affected Vendors
Affected Packages
Related Issues
Original source: https://github.com/advisories/GHSA-27vp-2mmc-vmh3
First tracked: May 28, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 85%