Crabbox EUVD-2026-29198

Exploitation requires the Islo provider configured in Crabbox <0.9.0 with sync.delete feature enabled in the workspace configuration. Victim must manually execute Crabbox commands (sync, run, or similar operations) against a workspace containing attacker-controlled .crabbox.yaml or crabbox.yaml files. No authentication or elevated privileges required (PR:N) once the malicious configuration is loaded, but the local attack vector (AV:L) means attacker cannot remotely trigger execution - victim must voluntarily run Crabbox in the malicious project directory. Exploitation limited by user interaction requirement (UI:R) and need for attacker to social-engineer distribution of malicious configuration files through trusted channels like code repositories or package registries.

CVSS 7.1 (High) reflects significant integrity and availability impact (I:H/A:H) but requires local access and user interaction (AV:L/UI:R). Real-world risk is moderate: attackers must social-engineer victims into opening a malicious Crabbox project, limiting scalability compared to remote vulnerabilities. No EPSS data provided, but absence from CISA KEV and lack of public POC suggest no widespread exploitation. Primary risk scenario is supply-chain attacks where malicious .crabbox.yaml files are embedded in shared repositories or developer tooling. The PR:N vector indicates no authentication required once the malicious config is loaded, but the local attack vector and mandatory user interaction (running Crabbox commands) significantly constrain exploitability versus the raw CVSS score.

Attacker distributes a seemingly legitimate open-source project or developer tool via GitHub/GitLab containing a malicious .crabbox.yaml with workspace path set to '../../../home/victim/.ssh'. When the victim clones the repository and runs crabbox sync or crabbox run with sync.delete enabled, the Islo provider executes rm -rf /home/victim/.ssh, deleting SSH keys and authorized_keys files. Subsequent mkdir -p could overwrite critical system files if pointed at /etc or other sensitive directories, enabling privilege escalation or denial of service.