nono-cli CVE-2026-47128

Exploitation requires all of the following concrete conditions: (1) the host Linux system has a running per-user systemd instance with the D-Bus socket active at /run/user/<uid>/bus - standard on most modern systemd-based Linux desktops and many server configurations; (2) the victim process is launched by nono-cli using an affected bundled profile (e.g., 'claude-code') or any custom profile that does not explicitly restrict Unix domain socket access; (3) the nono invocation includes a policy that permits shell execution (e.g., 'allow bash'), giving the sandboxed process the ability to invoke systemd-run; (4) the attacker has code execution within the sandboxed process - either as the AI agent itself responding to a crafted prompt, or via prompt injection into an agent accepting external input. Exploitation is limited to the launching user's existing OS permissions and does NOT provide privilege escalation, root access, cross-user access, or kernel compromise. Systems without a running systemd user instance (e.g., containers without systemd, non-systemd init systems, or user sessions explicitly configured without D-Bus) are not exploitable via this specific vector.

The CVSS 3.1 score of 6.1 (Medium) accurately reflects the local-only attack vector (AV:L) and low-privilege prerequisite (PR:L), which constrain the exposure compared to network-reachable vulnerabilities. However, within the specific threat model for which nono is deployed - containing AI coding agents such as Aider, Claude Code, or OpenCode running with 'allow bash' - the practical risk is substantially higher than the score implies. The integrity impact is rated HIGH (I:H) because the escape is reliable and complete, and the scope is unchanged (S:U), meaning no kernel or cross-user privilege escalation occurs; the blast radius is bounded by the launching user's existing permissions. A public proof-of-concept is embedded in the GitHub Security Advisory, lowering the barrier to exploitation. EPSS data was not provided in the available intelligence. The advisory tags include 'Privilege Escalation,' but this conflicts with the maintainer's explicit clarification that the issue does not provide privilege escalation, cross-user access, or host compromise beyond the invoking user's authority - the maintainer's statement is treated as authoritative. The risk is highest in CI/CD pipelines and AI-assisted development environments where nono is used to contain agents that accept external or untrusted input, since a single prompt injection can trigger the escape.

An AI coding agent running inside a nono sandbox configured with the 'claude-code' profile and --allow-bash is manipulated via prompt injection to execute the command 'systemd-run --user -q --wait --collect /bin/sh -c "malicious command"'. Because the sandbox policies do not restrict Unix domain socket access, the command communicates freely over the per-user D-Bus socket at /run/user/<uid>/bus, requesting that the host's systemd user instance spawn a new unsandboxed service. The resulting sibling process runs entirely outside nono's Landlock/seccomp policies and can write files to any user-accessible path, exfiltrate source code or credentials, or establish outbound network connections - all under the authority of the user who launched the original sandbox. A working one-liner reproducer is publicly documented in the GitHub Security Advisory.