Monthly
Sandbox escape in vxcontrol PentAGI up to 2.1.0 exposes a privilege boundary weakness in the Tool Management Protocol Handler, rooted in the pentester prompt template file. Remote unauthenticated attackers who can craft sufficiently complex inputs may bypass sandbox constraints on the AI agent's tool execution context, achieving limited confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exists on GitHub; no patch has been released and the vendor has not responded to disclosure - leaving all deployments on versions up to 2.1.0 without a vendor-sanctioned fix.
Sandbox boundary enforcement failure in PentAGI (vxcontrol) versions up to 2.1.0 allows authenticated remote users to break Docker containment controls via the Docker API client component in `backend/pkg/docker/client.go`, enabling limited information disclosure and unauthorized low-impact modifications within the Docker environment. The CVSS 4.0 vector (PR:L, AV:N, AC:L) confirms low-privilege network-reachable exploitation with no user interaction required, though all impact metrics remain Low and no host-level breakout is indicated. No public exploit code exists and this vulnerability is not listed in CISA KEV; an upstream fix is pending as an unmerged GitHub pull request.
Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipulate environment variables through the code execution tool, potentially breaking out of the intended security sandbox. The vulnerability has publicly available exploit code and the vendor has not responded to disclosure attempts, leaving systems unpatched.
Sandbox bypass in ByteDance verl up to version 0.7.0 allows remote attackers to achieve limited information disclosure through manipulation of the math_equal function in prime_math/grader.py. The vulnerability requires high attack complexity and has been publicly documented with exploit code available, though the vendor has not responded to early disclosure attempts.
Sandbox escape in NocoBase's plugin-workflow-javascript (all 2.0.x releases through 2.0.23) originates from a defective `createSafeConsole` implementation in the server-side `Vm.js` file, enabling remote attackers to break out of the JavaScript VM execution boundary and interact with the host Node.js process. A public proof-of-concept exploit has been released and documented on GitHub, and SSVC analysis classifies the attack vector as automatable. Despite the available PoC, EPSS probability sits at just 0.04% (12th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation activity at time of analysis.
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file uploads to the install-upload endpoint (install_plugin_upload function), enabling arbitrary code execution with limited information disclosure and integrity impact. The vulnerability exists in the plugin installation mechanism and has publicly available exploit code; the vendor has been notified but has not yet responded with a patch.
A vulnerability was found in OpenBMB XAgent 1.0.0. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in Electron and escalation of privilege if combined with a remote code execution. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sandbox escape in vxcontrol PentAGI up to 2.1.0 exposes a privilege boundary weakness in the Tool Management Protocol Handler, rooted in the pentester prompt template file. Remote unauthenticated attackers who can craft sufficiently complex inputs may bypass sandbox constraints on the AI agent's tool execution context, achieving limited confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exists on GitHub; no patch has been released and the vendor has not responded to disclosure - leaving all deployments on versions up to 2.1.0 without a vendor-sanctioned fix.
Sandbox boundary enforcement failure in PentAGI (vxcontrol) versions up to 2.1.0 allows authenticated remote users to break Docker containment controls via the Docker API client component in `backend/pkg/docker/client.go`, enabling limited information disclosure and unauthorized low-impact modifications within the Docker environment. The CVSS 4.0 vector (PR:L, AV:N, AC:L) confirms low-privilege network-reachable exploitation with no user interaction required, though all impact metrics remain Low and no host-level breakout is indicated. No public exploit code exists and this vulnerability is not listed in CISA KEV; an upstream fix is pending as an unmerged GitHub pull request.
Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipulate environment variables through the code execution tool, potentially breaking out of the intended security sandbox. The vulnerability has publicly available exploit code and the vendor has not responded to disclosure attempts, leaving systems unpatched.
Sandbox bypass in ByteDance verl up to version 0.7.0 allows remote attackers to achieve limited information disclosure through manipulation of the math_equal function in prime_math/grader.py. The vulnerability requires high attack complexity and has been publicly documented with exploit code available, though the vendor has not responded to early disclosure attempts.
Sandbox escape in NocoBase's plugin-workflow-javascript (all 2.0.x releases through 2.0.23) originates from a defective `createSafeConsole` implementation in the server-side `Vm.js` file, enabling remote attackers to break out of the JavaScript VM execution boundary and interact with the host Node.js process. A public proof-of-concept exploit has been released and documented on GitHub, and SSVC analysis classifies the attack vector as automatable. Despite the available PoC, EPSS probability sits at just 0.04% (12th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation activity at time of analysis.
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file uploads to the install-upload endpoint (install_plugin_upload function), enabling arbitrary code execution with limited information disclosure and integrity impact. The vulnerability exists in the plugin installation mechanism and has publicly available exploit code; the vendor has been notified but has not yet responded with a patch.
A vulnerability was found in OpenBMB XAgent 1.0.0. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in Electron and escalation of privilege if combined with a remote code execution. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.