9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42074

CVE-2026-42074: OpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injected model can escape the sandbox for any arbitrary command, achieving full host-level code execution. This issue has been patched in version 0.5.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42074

CVE-2026-42074:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaude	npm	< 0.5.1	0.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a sandbox bypass in OpenClaude, where the Language Model (LLM) can execute arbitrary code on the host machine. The root cause lies in the shouldUseSandbox function, which decides whether to run a command in a sandboxed environment. This function incorrectly trusted a model-controlled parameter, dangerouslyDisableSandbox, in the input for BashTool and PowerShellTool.

The analysis of the patch commit aab489055c53dd64369414116fe93226d2656273 reveals the key vulnerable functions. The core of the flaw was in shouldUseSandbox, which would disable sandboxing if dangerouslyDisableSandbox was true, because the secondary check, areUnsandboxedCommandsAllowed, defaulted to true.

The patch addresses this by introducing a new internal flag, _dangerouslyDisableSandboxApproved, which cannot be set by the model. The shouldUseSandbox function now requires this flag to be true before disabling the sandbox. Furthermore, the model-facing input schemas for BashTool and PowerShellTool were updated to remove the dangerouslyDisableSandbox parameter entirely, preventing the model from influencing this security-critical decision. Functions like runPowerShellCommand and normalizeToolInput were also part of the vulnerable execution flow as they propagated the malicious input to the decision-making logic.

Vulnerable functions

shouldUseSandbox

src/tools/BashTool/shouldUseSandbox.ts

This function contained the core logic of the vulnerability. It would return `false` (disabling the sandbox) based on the `dangerouslyDisableSandbox` parameter which could be controlled by the LLM, combined with a default setting `areUnsandboxedCommandsAllowed` which was true. The patch adds a requirement for an internal, trusted approval flag `_dangerouslyDisableSandboxApproved`.

runPowerShellCommand

src/tools/PowerShellTool/PowerShellTool.tsx

This function, which implements the execution logic for the PowerShell tool, directly called the vulnerable `shouldUseSandbox` function, passing along the `dangerouslyDisableSandbox` parameter received from the model-controlled input. This propagated the malicious input to the security decision point.

normalizeToolInput

src/utils/api.ts

This utility function was responsible for preparing tool inputs. It explicitly looked for and copied the `dangerouslyDisableSandbox` parameter from the parsed model output into the final input object for the tool. This behavior was removed in the patch, as it allowed the malicious parameter to be passed to the tool's execution logic.

BashTool.call

src/tools/BashTool/BashTool.tsx

The `BashTool.call` method is the entry point for executing a command from the model. Its input was validated against a schema that, prior to the patch, allowed the `dangerouslyDisableSandbox` parameter. The patch mitigates this by omitting `dangerouslyDisableSandbox` from the model-facing schema, preventing the model from controlling this parameter.

PowerShellTool.call

src/tools/PowerShellTool/PowerShellTool.tsx

Similar to `BashTool.call`, the `PowerShellTool.call` method's input schema allowed the `dangerouslyDisableSandbox` parameter to be set by the model. This input was then passed to the `runPowerShellCommand` function, leading to the sandbox bypass. The patch removes this parameter from the model-facing schema.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.