CVE-2026-47213
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Boxlite in versions 0.8.2 and prior uses SIGALRM instead of SIGKILL to kill processes after a timeout. Malicious code inside the sandbox can catch this signal and continue running, leading to resource exhaustion and affecting the availability of the Boxlite service.
Risk Assessment
The risk is that malicious code can exhaust virtual machine resources, potentially disrupting the Boxlite service and affecting other users.
Recommendation
It is recommended to apply the fix from commit 28159fc or upgrade to a newer version of Boxlite that uses SIGKILL.
Other vulnerabilities in Boxlite
See all- CVE-2026-46703Critical
Vulnerability in Boxlite before version 0.9.0. Users can specify OCI images, and when processing tar entries, symlinks to absolute paths are not checked. An attacker can host a malicious image on DockerHub, allowing arbitrary file writes on the host and remote code execution.
- CVE-2026-46695Critical
Boxlite prior to version 0.9.0 does not restrict kernel capabilities inside the container, allowing malicious code to remount directories in rw mode and gain write access to read-only directories. Fixed in version 0.9.0.
Original NVD description (English source)
Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.