CVE-2026-46695
Boxlite is a sandbox service that lets users run untrusted OCI containers in lightweight virtual machines. Before version 0.9.0, the service did not limit kernel capabilities inside the container, allowing malicious code to remount read‑only directories as read‑write and write to them. The issue has been fixed in Boxlite 0.9.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Boxlite sandbox service, versions earlier than 0.9.0, used by developers or anyone running untrusted code in a sandboxed environment.
Real-world impact
An attacker could modify files that should be protected, potentially altering configuration files, injecting malware, or compromising the integrity of the system running the container.
Why this severity
The CVSS score of 10 reflects that the vulnerability requires no authentication or user interaction, and it allows an attacker to gain full control over data confidentiality and integrity within the sandbox.
What to do about it
- 01Upgrade Boxlite to version 0.9.0 or later.
NVD-referenced vendor advisory
Timeline
- Jun 10, 2026 · Jun 10, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 23, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.