The Lab · 2026-04-22 19:27:30 · GitHub Issues
A critical security vulnerability allowing container escape through path traversal remains exploitable on the origin/main branch, according to a newly disclosed GitHub issue. The flaw, designated F1085, exists in the deleteViaEphemeral function within container_files.go and exploits how the rm command handles multiple ...
The Lab · 2026-04-22 22:54:19 · GitHub Issues
A serious OS command injection flaw has been identified and patched in workspace-server, potentially allowing malicious actors to delete files outside the intended `/configs` volume directory. The vulnerability, designated F1085 and classified as CWE-78, stems from how the `deleteViaEphemeral` function constructs shell...
The Lab · 2026-04-22 23:54:11 · GitHub Issues
A critical scope vulnerability has been identified in the `deleteViaEphemeral` utility function, classified under F1085 and mapped to CWE-78 and CWE-22. The flaw causes the function to delete the entire `/configs` volume mount rather than scoped individual files, representing a severe data destruction risk for any syst...