CVE-2026-42074

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42074", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-23T19:17:30.565Z", "datePublished": "2026-06-02T15:38:24.753Z", "dateUpdated": "2026-06-02T17:53:35.232Z"}, "containers": {"cna": {"title": "OpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg"}, {"name": "https://github.com/Gitlawb/openclaude/pull/778", "tags": ["x_refsource_MISC"], "url": "https://github.com/Gitlawb/openclaude/pull/778"}, {"name": "https://github.com/Gitlawb/openclaude/commit/aab489055c53dd64369414116fe93226d2656273", "tags": ["x_refsource_MISC"], "url": "https://github.com/Gitlawb/openclaude/commit/aab489055c53dd64369414116fe93226d2656273"}], "affected": [{"vendor": "Gitlawb", "product": "openclaude", "versions": [{"version": "< 0.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-02T15:38:24.753Z"}, "descriptions": [{"lang": "en", "value": "OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injected model can escape the sandbox for any arbitrary command, achieving full host-level code execution. This issue has been patched in version 0.5.1."}], "source": {"advisory": "GHSA-m77w-p5jj-xmhg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T17:53:30.436779Z", "id": "CVE-2026-42074", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T17:53:35.232Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42074", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-02T17:53:30.436779Z"}}}], "references": [{"url": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T17:52:33.911Z"}}], "cna": {"title": "OpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input", "source": {"advisory": "GHSA-m77w-p5jj-xmhg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Gitlawb", "product": "openclaude", "versions": [{"status": "affected", "version": "< 0.5.1"}]}], "references": [{"url": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg", "name": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Gitlawb/openclaude/pull/778", "name": "https://github.com/Gitlawb/openclaude/pull/778", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Gitlawb/openclaude/commit/aab489055c53dd64369414116fe93226d2656273", "name": "https://github.com/Gitlawb/openclaude/commit/aab489055c53dd64369414116fe93226d2656273", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injected model can escape the sandbox for any arbitrary command, achieving full host-level code execution. This issue has been patched in version 0.5.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-02T15:38:24.753Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42074", "state": "PUBLISHED", "dateUpdated": "2026-06-02T17:53:35.232Z", "dateReserved": "2026-04-23T19:17:30.565Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-02T15:38:24.753Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openclaude", "vendor": "Gitlawb", "versions": [{"status": "affected", "version": "< 0.5.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlawb:openclaude:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2107920-62CC-4630-84F0-724AB1B17015", "versionEndExcluding": "0.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injected model can escape the sandbox for any arbitrary command, achieving full host-level code execution. This issue has been patched in version 0.5.1."}, {"lang": "es", "value": "OpenClaude es una interfaz de l\u00ednea de comandos de agente de codificaci\u00f3n de c\u00f3digo abierto para proveedores de modelos en la nube y locales. Antes de la versi\u00f3n 0.5.1, el par\u00e1metro dangerouslyDisableSandbox est\u00e1 expuesto como parte del esquema de entrada de BashTool, lo que significa que el LLM (una entidad no confiable seg\u00fan el modelo de amenazas propio del proyecto) puede establecerlo en verdadero en cualquier respuesta de tool_use. Combinado con la configuraci\u00f3n predeterminada allowUnsandboxedCommands: true, un modelo inyectado por prompt puede escapar del sandbox para cualquier comando arbitrario, logrando la ejecuci\u00f3n de c\u00f3digo a nivel de host completo. Este problema ha sido parcheado en la versi\u00f3n 0.5.1."}], "id": "CVE-2026-42074", "lastModified": "2026-07-22T19:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42074", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T17:53:30.436779Z", "version": "2.0.3"}}]}, "published": "2026-06-02T17:16:32.073", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Gitlawb/openclaude/commit/aab489055c53dd64369414116fe93226d2656273"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/Gitlawb/openclaude/pull/778"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.5.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openclaude", "source": "cna", "vendor": "Gitlawb"}, "product": "openclaude", "vendor": "gitlawb"}], "created": "2026-06-02T18:30:14.761341+00:00", "updated": "2026-06-02T18:30:15.032937+00:00", "vendors": ["gitlawb", "gitlawb$PRODUCT$openclaude"]}