The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.
" } ] } ], "references": [ { "url": "https://github.com/beam-cloud/beta9", "name": "Beta9 repository", "tags": [ "product" ] }, { "url": "https://github.com/beam-cloud/beta9/pull/1897", "name": "Handle sandbox edge cases (fix pull request)", "tags": [ "patch" ] }, { "url": "https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393", "name": "Fix commit a28bf12", "tags": [ "patch" ] }, { "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756", "name": "worker-0.1.756", "tags": [ "release-notes" ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "Tenant with a workspace token and a running sandbox on a worker that serves the sandbox file API" } ], "cvssV3_1": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } } ], "solutions": [ { "lang": "en", "value": "Upgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "Upgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15.
" } ] } ], "timeline": [ { "time": "2026-09-15T04:03:00.000Z", "lang": "en", "value": "Fix merged in pull request 1897 (commit a28bf12)" }, { "time": "2026-09-15T04:03:00.000Z", "lang": "en", "value": "Fixed release worker-0.1.756 published. No vendor security advisory was filed with the pull request." } ], "credits": [ { "lang": "en", "value": "Natan Nehorai", "type": "finder" }, { "lang": "en", "value": "JFrog Security Research", "type": "coordinator" } ], "source": { "discovery": "EXTERNAL" }, "x_generator": { "engine": "Vulnogram 1.0.5" } } } }