sandboxed.sh up to version 1.3.0 contains a flaw where the nsenter command is invoked without the --root flag, allowing code executing inside a container workspace to bind into the host's root namespace. As a result, attackers can resolve absolute paths on the host and read or modify any file on the host filesystem, effectively escaping the intended isolation of the container. This enables full read/write privileges on the host and can lead to compromise of the host system. The weakness is categorized as CWE-1188.

The affected product is sandboxed.sh by Th0rgal, versions up to and including 1.3.0 are vulnerable. The vulnerability is not applicable to later releases once the missing root namespace issue is fixed.

The CVSS score of 9.3 indicates a severe vulnerability. Although the EPSS score is not available, the lack of presence in the KEV catalog suggests no zero‑day exploit has been documented yet, but the ease of exploitation makes it a high priority. The likely attack vector is any user who can submit or run code within a sandboxed.sh container workspace, either directly or indirectly through automated workflows. If exploited, an attacker can read sensitive configuration files, change system binaries, or deploy persistence mechanisms on the host.