CyberRota Analysis
AI-GeneratedA vulnerability in bubblewrap allows an attacker to create files or directories outside the sandbox by exploiting a symlink during the sandbox setup process, potentially leading to unauthorized access or modification of host files. This flaw poses a high risk, particularly for environments that rely on bubblewrap for container isolation. Organizations using bubblewrap should prioritize updating to version 0.12.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.