Re: bubblewrap 0.12.0 fixes writes outside sandbox
Red Hat Product Security allocated CVE-2026-87766 for a bubblewrap flaw fixed in 0.12.0 that allowed writes outside the sandbox.
CVE-2026-87766 has been allocated by Red Hat Product Security for the bubblewrap sandboxing tool vulnerability that permitted writes outside the sandbox. The fix shipped in bubblewrap 0.12.0, and the oss-security advisory was updated with the new CVE identifier. The short follow-up post provides no exploitation details.
- CVE-2026-87766 assigned by Red Hat Product Security
- Fix available in bubblewrap 0.12.0
- CVEs
- CVE-2026-87766
- Vendors
- Red Hat
- Products
- bubblewrap
- Organizations
- Red Hat Product Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87766 | Symlink-following sandbox escape (arbitrary file write) in bubblewrap before 0.12.0 | 8.8 | <1% |
From the original article
Posted by Simon McVittie on Sep 09 CVE-2026-87766 has now been allocated for this vulnerability (thanks to Red Hat Product Security). I've updated the advisory accordingly. smcv
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.