https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 05:16:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-339127 EUVD-2026-339127 https://cve.radiocsirt.org/vuln/euvd-2026-339127 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47128 <p>nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.</p> <p>nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47128 https://cve.radiocsirt.org/vuln/ghsa-27vp-2mmc-vmh3 <p><strong>Affected:</strong> crates.io: nono-cli</p> <p>### Summary</p> <p>The nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket.</p> <p>Threat scenario: Running Aider, Claude Code, OpenCode or similar tools with &#34;allow bash&#34; policy so that it can invoke arbitrary host tools like `make`, `gcc`, etc. to write code.</p> <p>### Reproducer</p> <p>Here, instead of running a tool like `opencode` or `claude` one can just invoke `systemd-run`, but this is something an agent could be tricked into doing:</p> <p>```bash $ cd ~/src/myproject $ nono run -s --allow-cwd --profile claude-code -- \ systemd-run --user -q --wait --collect \ /bin/sh -c &#34;echo oops &gt; ~/Documents/escaped.txt&#34; $ cat /var/home/test/Documents/escaped.txt oops $ ```</p> <p>### Impact</p> <p>Complete sandbox escape. The unsandboxed sibling process can write anywhere the user can write, spawn arbitrary processes with network access, etc.</p> <p>### Maintainer Context</p> <p>This issue allows a process running inside the sandbox to escape confinement by interacting with local user-scoped IPC mechanisms and regain the authority already held by the invoking user or service account.</p> <p>The issue impacts the sandbox’s confinement and blast-radius reduction guarantees for agents and sandboxed tooling. However, exploitation does not provide privilege escalation, cross-user access, or host compromise beyond the permissions already available to the launcher outside the sandbox.</p> <p>This issue affects t…</p> <p><strong>Affected:</strong> crates.io: nono-cli</p> <p>### Summary</p> <p>The nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket.</p> <p>Threat scenario: Running Aider, Claude Code, OpenCode or similar tools with &#34;allow bash&#34; policy so that it can invoke arbitrary host tools like `make`, `gcc`, etc. to write code.</p> <p>### Reproducer</p> <p>Here, instead of running a tool like `opencode` or `claude` one can just invoke `systemd-run`, but this is something an agent could be tricked into doing:</p> <p>```bash $ cd ~/src/myproject $ nono run -s --allow-cwd --profile claude-code -- \ systemd-run --user -q --wait --collect \ /bin/sh -c &#34;echo oops &gt; ~/Documents/escaped.txt&#34; $ cat /var/home/test/Documents/escaped.txt oops $ ```</p> <p>### Impact</p> <p>Complete sandbox escape. The unsandboxed sibling process can write anywhere the user can write, spawn arbitrary processes with network access, etc.</p> <p>### Maintainer Context</p> <p>This issue allows a process running inside the sandbox to escape confinement by interacting with local user-scoped IPC mechanisms and regain the authority already held by the invoking user or service account.</p> <p>The issue impacts the sandbox’s confinement and blast-radius reduction guarantees for agents and sandboxed tooling. However, exploitation does not provide privilege escalation, cross-user access, or host compromise beyond the permissions already available to the launcher outside the sandbox.</p> <p>This issue affects t…</p> https://cve.radiocsirt.org/vuln/ghsa-27vp-2mmc-vmh3