crates.io boxlite-cli vulnerabilities

Latest crates.io boxlite-cli CVEs

Newest publication first

1. CVE-2026-46695 BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files

   Published 2026-06-10

   Critical·CVSS 10.0 EPSS 0.29%

   Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can...

2. CVE-2026-46703 BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host

   Published 2026-06-10

   Critical·CVSS 9.6 EPSS 0.48%

   Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite allows users to specify the OCI image used by containers in the sandbox. However, when proces...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.