EUVD-2026-66092
GHSA-vrm8-9q5m-p369
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv access inside sandbox
-
DeliveryPlant malicious artifact on search path
-
ExploitTrigger sandbox resource load
-
ExecutionHijacked path executes attacker code
-
PersistEscape to host authority
-
ImpactEscalate and exfiltrate host data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires the attacker to already hold low-level privileges within an OpenShell deployment (PR:L per CVSS) and to influence a search path element the sandbox resolves - that is, to write or place a malicious library, binary, or config into a directory OpenShell searches when locating a resource. No user interaction is required (UI:N). Limiting factors: the attacker must have an existing foothold or account capable of running inside the sandbox, and must control at least one attacker-writable location on the sandbox's resolution path; if OpenShell resolves all resources from fixed, non-writable absolute paths, the search-path hijack cannot be staged. The NVD vector marks AV:N, but sandbox escape via CWE-427 typically presumes local in-sandbox code execution - defenders should verify whether remote reachability truly applies to their configuration. |
| Impact | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) portrays a low-complexity, low-privilege, scope-changing attack with total confidentiality, integrity, and availability impact - nominally critical. However, the signals are partly in tension: CWE-427 uncontrolled-search-path flaws and 'sandbox escape' semantics usually require the attacker to already be executing code inside the sandbox, which implies a local foothold precondition rather than pure network reach - the AV:N rating should be verified against NVIDIA's advisory. There is no EPSS score, no KEV listing, and no evidence of a public POC in the provided data, so despite the high base score there is no confirmation of real-world exploitation; treat this as high-severity-if-reachable rather than a confirmed active emergency. The scope change combined with PR:L is the key risk driver: any workload that lets semi-trusted code run inside OpenShell is meaningfully exposed. |
| Exploit ScenarioDerived | An attacker able to run low-privileged code inside an OpenShell sandbox plants a malicious library or executable in a directory the sandbox's resolution logic searches ahead of the legitimate location. When OpenShell next loads that resource, the attacker's code executes with the sandbox host's trust, crossing the isolation boundary to run arbitrary code and read or tamper with host data. No public exploit code is currently identified, so this reflects the described capability rather than an observed campaign. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.
RemediationAI
Apply the fix described in NVIDIA's product-security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5872; no exact fixed version number is present in the provided data, so consult that advisory for the specific patched build (no vendor-released fix version independently confirmed from available data at time of analysis). As compensating controls until patched: restrict who can execute code inside OpenShell so the PR:L precondition cannot be met by untrusted users; pin and lock down every search path the sandbox consults by setting absolute, non-writable paths for libraries, plugins, and helper binaries and removing attacker-writable or current-working-directory entries such as empty or '.' path elements - note this may break setups that rely on user-supplied plugin directories; run OpenShell under least privilege with mandatory access control (SELinux/AppArmor) and reduced filesystem write access to blunt a successful escape, at the cost of tighter operational constraints. Monitor for unexpected loads of libraries or executables from world-writable locations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is NVIDIA OpenShell (cpe:2.3:a:nvidia:openshell), a shell/execution-sandbox environment for Linux. The root cause class is CWE-427 (Uncontrolled Search Path Element): the software resolves a library, plugin, executable, or configuration resource via a search path that includes a location an attacker can influence, causing it to load an unintended, attacker-controlled artifact. In a sandbox context this is especially damaging because the loaded code runs with the trust of the sandbox host rather than the confined process, turning a hijacked path element into a boundary-crossing primitive. The CVSS scope-changed metric (S:C) confirms the impact crosses from the vulnerable sandboxed component into a separate security authority - the host.
Know when Openshell gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-427 search-path sandbox escape presumes attacker code already runs in the sandbox (AV:L, PR:L, AC:L); the escape crosses into host authority (S:C) with full C/I/A impact.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
Articles & Coverage 2
Executive ViewAI
NVIDIA OpenShell for Linux contains a critical sandbox escape vulnerability (CVSS 9.9) that allows low-privileged users already operating within a sandbox to break isolation boundaries and achieve full code execution and privilege escalation on the host system. This directly impacts organizations running untrusted code or multi-tenant workloads in containerized environments, as a compromise of one tenant can cascade to the entire host infrastructure. The absence of an available patch requires immediate compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the execution of untrusted or third-party code within OpenShell sandboxes; implement strict privilege separation at the host level to limit post-escape impact; deploy enhanced runtime monitoring to detect anomalous resource access patterns and privilege escalation attempts; consider temporary discontinuation of OpenShell on systems handling sensitive data pending patch availability; segment OpenShell-dependent systems from critical infrastructure via network policies and host-level firewalls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sa
OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to
Path traversal in NVIDIA OpenShell Sandbox for Linux permits low-privileged network-authenticated attackers to bypass L7
OS command injection in NVIDIA OpenShell for Linux's sandbox exec handler allows a low-privileged, network-accessible at
Improper output encoding in NVIDIA OpenShell's inference proxy on Linux allows a local low-privileged attacker to cause
Exploit-DB