CriticalVulnerability

GHSA-g6ww-w5j2-r7x3: BoxLite: Permission Bypass Allows Modification of Read-Only Files

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-46695GHSA-g6ww-w5j2-r7x3
Published: May 21, 2026
Record updated: October 9, 2026

Affected: boxlite-cli < 0.9.0
boxlite < 0.9.0
github.com/boxlite-ai/boxlite/sdks/go < 0.9.0
and 1 more
Fixed in: 0.9.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.5%

Summary

BoxLite, a sandbox service that runs untrusted code in lightweight VMs and OCI containers, enforces its read_only host mounts only by adding the MS_RDONLY flag after the VM starts. Because the container is not restricted in kernel capabilities, malicious code can remount the directory read-write and modify data that should be read-only, potentially reaching code execution on the host.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.5%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 12, 2026.
Disclosure date: May 21, 2026

Affected

Packages: boxlite-cli@< 0.9.0 (fixed: 0.9.0)
boxlite@< 0.9.0 (fixed: 0.9.0)
github.com/boxlite-ai/boxlite/sdks/go@< 0.9.0 (fixed: 0.9.0)
@boxlite-ai/boxlite@< 0.9.0 (fixed: 0.9.0)
boxlite@< 0.9.0 (fixed: 0.9.0)

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: Agent
Impact: Integrity,
Confidentiality
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-g6ww-w5j2-r7x3

First tracked: May 21, 2026 at 08:00 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 85% (self-assessed)

Summary

Mitigation

Related items