CVE-2026-46695: Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code…

PriorityP269critical10CVSS 3.1

AVNACLPRNUINSCCHIHAN

EPSS

0.29%

20.6th percentile

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directory in rw mode, thereby gaining write access to that directory. This allows malicious code to perform arbitrary write operations on directories that should be read-only. This issue has been patched in version 0.9.0.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
boxlite-ai	boxlite	< 0.9.0	0.9.0
boxlite-ai	boxlite	>= 0 < 0.9.0	0.9.0
github.com	boxlite-ai_boxlite_sdks_go	>= 0 < 0.9.0	0.9.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.