Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a critical permission bypass in Boxlite's sandboxing mechanism. It stems from two core issues that work in concert. First, the read_only flag for volume mounts was not enforced at the hypervisor level. The code in vmm::krun::engine::Krun::create and vmm::krun::context::KrunContext::add_virtiofs failed to pass the read_only setting to the underlying libkrun library, which itself initially lacked this feature. This meant all virtiofs shares were exposed to the guest VM as read-write at the device level.
Second, the guest container was granted all 41 Linux capabilities by the container::capabilities::all_capabilities function. This included CAP_SYS_ADMIN, a powerful capability that allows a process to perform administrative tasks, including remounting filesystems.
An attacker could exploit this by running code inside the sandbox that executes mount -o remount,rw on a directory that was intended to be read-only. Because the container had CAP_SYS_ADMIN and the underlying virtiofs share was already read-write from the hypervisor's perspective, this operation would succeed, giving the attacker write access to the host filesystem. The patch remediates this by using a newer libkrun function to enforce read-only at the hypervisor level and by stripping CAP_SYS_ADMIN and other dangerous capabilities from the container's default set.
vmm::krun::engine::Krun::createsrc/boxlite/src/vmm/krun/engine.rs
vmm::krun::context::KrunContext::add_virtiofssrc/boxlite/src/vmm/krun/context.rs
container::capabilities::all_capabilitiessrc/guest/src/container/capabilities.rs
container::spec::build_default_capabilitiessrc/guest/src/container/spec.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| boxlite | pip | < 0.9.0 | 0.9.0 |
| @boxlite-ai/boxlite | npm | < 0.9.0 | 0.9.0 |
| github.com/boxlite-ai/boxlite/sdks/go | go | < 0.9.0 | 0.9.0 |
| boxlite | rust | < 0.9.0 | 0.9.0 |
| boxlite-cli | rust | < 0.9.0 | 0.9.0 |