Topic
8 articles
CyberSecureToday covers Sandbox Escape across 8 articles published between 20 Sep 2026 and 31 Oct 2026.
The coverage includes 7 vulnerability advisories and 1 analysis or guidance piece. 7 advisories are rated critical or high severity.
Stories on Sandbox Escape most often intersect with Remote Code Execution, CWE-94 and vm2, with Technology, Cloud & SaaS the most affected sector. The most recent story, “OpenAI Patches Critical ChatGPT Shared-Link Flaw Permitting Session Hijacking and Private Chat Theft”, was published 31 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
Agentic AIA critical P1 vulnerability in ChatGPT's shared-conversation feature allowed attackers to execute arbitrary scripts in victim sessions to exfiltrate private chats.
GoogleGoogle patches a critical breakout flaw in Vertex AI Agent Builder (CVE-2026-76215) allowing recursive tool invocations to escape sandboxes and exfiltrate IAM tokens.
GoogleGoogle released Chrome 154.0.8037.97 resolving a critical out-of-bounds write flaw in WebGL (CVE-2026-103628) that exposes memory to arbitrary code execution.
LinuxA critical vulnerability in Foreman allows authenticated users to escape the safemode Ruby templating sandbox via delegated method manipulation, executing commands as root.
Threat IntelA critical sandbox escape in vm2 allows sandboxed scripts in Node.js 24+ to reach the node:test runner and invoke run() with arbitrary execArgv CLI flags.
Crypto / Web3A critical sandbox escape in vm2 allows untrusted NodeVM scripts to invoke OpenSSL engine loading via crypto.setEngine, executing arbitrary native code on the host.
Threat IntelCrewAI maintainers resolve vulnerability CVE-2026-2275 in CodeInterpreter tool allowing arbitrary host command execution via malicious Python payloads.
Agentic AIOpen WebUI security release patches high-severity vulnerability CVE-2026-45672 allowing sandbox escapes and arbitrary host execution via crafted pipeline code.