praisonal SandboxExecutor Network Isolation Bypass: CVE-2026-57125, CWE-693, PoC & Fix Details

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: A network isolation bypass exists in the mode of within the npm package Vulnerability Type: Network Isolation Bypass Impact: The mode implements isolation solely by setting proxy environment variables (such as , , etc.), and does not use OS-level network namespaces, firewall rules, or socket filters. For non-proxy-aware clients that do not read proxy variables (such as Node.js's or Python's ), network access remains reachable, rendering the isolation ineffective. Severity: High (CVSS 3.1 score 7.6/10) CVE: CVE-2026-57125 CWE: CWE-693 (Protection Mechanism Failure) Scope of Impact Affected Package: Affected Versions: Fixed Version: Affected Component: TypeScript CLI feature Affected Repository: Remediation 1. Recommended: For a true mode, commands should be executed within an OS-enforced network boundary (e.g., network namespace, firewall rules, sandboxed process, container, VM, or platform-specific socket filters). 2. Alternative: If the intent is merely to hint to cooperating clients, the mode should be renamed (e.g., ), and documentation should explicitly state that it is not a security boundary, while reserving to be available only when OS-level enforcement is present. 3. Default Policy: Consider default-deny for outbound connections and explicitly allow the specific outbound destinations reachable by sandboxed commands. POC Code Reproduction Command: POC Steps: 1. Install into a temporary project 2. Start a benign HTTP server bound to a random local port on 3. Create 4. Verify that the child process environment variables include the proxy variables 5. Run as a proxy-aware control group (it should fail, unable to reach the server) 6. Run (without proxy) — it does reach the server and prints the marker Summary of Observed Output ( ): Key Code Snippets: Mode definition: method: branch in :

Goal Reached Thanks to every supporter — we hit 100%!

praisonal SandboxExecutor Network Isolation Bypass: CVE-2026-57125, CWE-693, PoC & Fix Details

More from this source