CVE-2026-46695

The record

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directory in rw mode, thereby gaining write access to that directory. This allows malicious code to perform arbitrary write operations on directories that should be read-only. This issue has been patched in version 0.9.0.

Affected packages

Related vulnerabilities

• GHSA-g6ww-w5j2-r7x3 BoxLite: Permission Bypass Allows Modification of Read-Only Files Same vulnerability
• CVE-2026-46703 Boxlite is a sandbox service that allows users to create lightweight virtual machines… Also affects github.com/boxlite-ai/boxlite/sdks/go
• GHSA-f396-4rp4-7v2j Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host Also affects github.com/boxlite-ai/boxlite/sdks/go
• CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-284
• CVE-2026-83395 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-284
• CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-284
• CVE-2026-106580 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-284
• CVE-2026-61700 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-284