60
60
60
60
47
iceener/files-stdio-mcp-server: sandbox escape in fs_search via a symlinked directory (recursive walker validates only the top level)
iceener/files-stdio-mcp-server allows a read-side sandbox escape: fs_search follows symlinked directories while the recursive walker validates confinement only at the top level.
A vulnerability report describes a read-side sandbox escape in iceener/files-stdio-mcp-server, an MCP server for text-based file access that explicitly promises 'Sandboxed filesystem access. Only these paths are available'. The fs_search tool can follow symlinked directories outside the allowed paths, and the recursive directory-listing walker used by fs_search (and by fs_read) validates confinement only at the top level. The same flaw affects fs_read's directory-listing walker. No CVE identifier was assigned in the provided report text.
35
60
60
55
50
CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs
Apache Syncope patches an important Groovy sandbox escape (CVE-2026-77147) allowing administrators to achieve code injection via empty CommandArgs.
CVE-2026-77147 is an important-severity improper control of code generation vulnerability in Apache Syncope, rated as a Groovy sandbox escape for empty CommandArgs. An administrator with adequate privileges can exploit the flaw to achieve code injection. Affected versions include syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
25
60
60
50
60
35
60
60
60
60
60
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
Critical type-confusion flaw in isolated-vm Node.js sandbox (GHSA-864f-rcv7-6rh4) enables guest-to-host escape and potential RCE; fixed in 6.2.0 and 7.0.1.
Endor Labs researcher Cristian-Alexandru Staicu found a type confusion in the ExternalCopy component's handling of the transferList option in isolated-vm, letting sandboxed JavaScript corrupt host-process memory and escalate from controlled-address crashes to full control-flow hijack of the host, i.e., potential remote code execution. The flaw, tracked as GHSA-864f-rcv7-6rh4 with no CVE yet, affects all versions through 7.0.0 of the library, which sees nearly 1 million npm downloads weekly. It was patched in versions 6.2.0 and 7.0.1 released earlier in August 2026, and full exploit details are withheld to prevent attacks. The V8 Isolate boundary itself held; the failure was in the C++ marshalling code bridging host and guest.
58
60
60
60
30
60
Urgent: Google Releases Critical Chrome Update for CVE-2025
60
Critical Docker Sandbox Vulnerabilities Enable Malicious Guests to Escape Isolated microVM Workspacesnew
Docker patched two sandbox-escape flaws, CVE-2026-77179 and CVE-2026-79994, letting malicious guest workloads access host files and sockets.
Docker fixed CVE-2026-77179 (Critical), a virtio-fs symlink race in Docker Sandboxes 0.28.0 through before 0.42.0 on macOS that could let a guest read or modify arbitrary host files and potentially reach code execution, and CVE-2026-79994 (High), a time-of-check-to-time-of-use flaw in the guest-to-host Unix socket relay affecting 0.37.0 through before 0.42.0. Fixes shipped in Docker Sandboxes 0.42.0, released September 7; Docker recommends clone mode and avoiding read-write host mounts as interim mitigations. The article also references the earlier destination-escape flaw CVE-2026-17106 in docker cp, fixed in Docker Desktop 4.86.0. No exploitation is reported.
62
30
60
60
60
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.
Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.
70
Survey of filesystem MCP servers: how the "sandboxed filesystem" boundary is enforced (one breach, four defended-by-design)
Survey finds one filesystem MCP server vulnerable to a symlink-based sandbox escape while four others are defended by design.
A survey of five filesystem MCP servers assessed how each enforces its path-confinement boundary against symlink escapes in recursive directory walkers. The iceener/files-stdio-mcp-server is vulnerable to a read-side sandbox escape. The other four are defended by design or make no confinement claim. The author describes the vulnerability class as small but real.
30
60
60
60
60
Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials
60