HIGHVulnerability
CVE-2026-87766
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.
Properties
- severity
- HIGH
- score
- 8.8
- cve_id
- CVE-2026-87766
- signal_observed_at
- 2026-09-23T04:35:38+00:00
- vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- published_at
- 2026-09-09T09:17:12.540
- last_modified
- 2026-09-22T23:17:07.763
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]Improper Link Resolution Before File Access ('Link Following')
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph