What happened
Published 2026-10-12 (CVSS 8.8 v3.1 scope-changed / 9.3 v4.0, CWE-1188) by VulnCheck. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation. Verified via NVD REST API.
Why it matters
Sandbox isolation is the primary mitigation for prompt-injected / AI-generated code execution. A container-escape in the sandbox layer converts the agent-execution problem into host compromise: the blast radius is every host running sandboxed.sh, and the exploit path requires no human approval.
Attack vector
Agent-run (prompt-injected or untrusted) code inside a container workspace triggers the escape: the flaw is that workspace attachment uses nsenter without chroot --root, so absolute host paths are resolvable from within the workspace, allowing read/write of host files.
Affected systems
sandboxed.sh / Th0rgal orb through 1.3.0 (container sandbox for AI-agent code execution)
Mitigation
No fixed release stated in the window; see commit 4ab42e91 and VulnCheck advisory. Do not rely on sandboxed.sh for isolation of untrusted agent code until patched.