RUSTSEC-2026-0147

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0147

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0147.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0147

Aliases

Published

2026-05-16T12:00:00Z

Modified

2026-06-29T12:26:07Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Read-only volume remount bypass via guest CAP_SYS_ADMIN

Details

Affected versions of boxlite mount host directories shared via virtiofs as guest-side read-only by setting MS_RDONLY from the guest. Because the default guest capability set included CAP_SYS_ADMIN, untrusted code running inside a sandbox could execute mount -o remount,rw <path> to re-flag the share as read-write and then write through to the host filesystem — fully escaping the read-only contract boxlite advertised to callers.

The fix in v0.9.0 enforces read-only at the hypervisor level via krun_add_virtiofs3 (so the guest's MS_RDONLY is no longer the authoritative gate) and drops CAP_SYS_ADMIN from the default guest capability set (matching Docker's defaults).

This is a sandbox-escape bug: boxlite is a sandboxing runtime, so the read-only invariant is part of its security contract. CVSS rated 10.0 by the upstream advisory.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / boxlite

Package

Name: boxlite; View open source insights on deps.dev
Purl: pkg:cargo/boxlite

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.9.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}