Skip to content

feat: AVE-2026-00088, Sandbox Side-Effect Trust Handoff #331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chaksaray wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

feat: AVE-2026-00088, Sandbox Side-Effect Trust Handoff #331

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,25 @@ Format: [Semantic Versioning](https://semver.org). Schema versions and record se
new record.

### Added
- AVE-2026-00088: Sandbox side-effect trust handoff. A sandboxed
coding agent, steered by content it reads, writes a file the sandbox
allows (a hook definition, an editor task, Git metadata or hooks, the
agent tool's own project configuration, a virtualenv interpreter),
and a more-privileged component outside the sandbox later executes
it as trusted configuration, so the agent's side effect runs on the
host. Sourced from the vendor advisories for CVE-2026-48124,
CVE-2026-25725, CVE-2026-26268 and CVE-2026-73217, Pillar Research's
"The Week of Sandbox Escapes" series and Cymulate Research Labs'
"Configuration-Based Sandbox Escape" research, each read directly.
Distinct from AVE-2026-00064 (attacker-supplied configuration that
auto-runs on project load; here the sandboxed agent is the writer and
the boundary is the sandbox-to-host handoff), and from 00054, 00050,
00084, 00071, 00075 and 00063, checked field by field. Docker-socket,
allow-default seatbelt and command-allowlist findings from the same
research were excluded as different mechanisms. researcher field
credits Pillar Research, Cymulate Research Labs and the researchers
the CVE-2026-26268 advisory names, not AVE. Id proposed via issue
#330 (MEDIUM, AIVSS 6.4).
- AVE-2026-00087: Agentjacking — a monitoring/diagnostic integration's
own publicly-writable ingest endpoint lets an attacker plant a
crafted event formatted to visually mimic the integration's
Expand Down
11 changes: 6 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ Stable IDs, AIVSS scores, and behavioral fingerprints for every way a skill file
MCP server, system prompt, or agent plugin can be weaponized — scored consistently,
mapped to the frameworks security teams already report against.

[![Records](https://img.shields.io/badge/records-87-0f6e56?style=flat-square)](records/)
[![Records](https://img.shields.io/badge/records-88-0f6e56?style=flat-square)](records/)
[![Schema](https://img.shields.io/badge/schema-v1.1.0-0a3024?style=flat-square)](schema/ave-record-1.1.0.schema.json)
[![AIVSS](https://img.shields.io/badge/AIVSS-v0.8-d4a017?style=flat-square)](https://aivss.owasp.org)
[![OWASP MCP](https://img.shields.io/badge/OWASP-MCP%20Top%2010-0a3024?style=flat-square)](https://owasp.org)
Expand Down Expand Up @@ -102,7 +102,7 @@ two published AVE records, corrected the underlying process
documentation, not just the two records, credited in
[CONTRIBUTORS.md](CONTRIBUTORS.md).

87 records. 8 independent crosswalks. See
88 records. 8 independent crosswalks. See
[crosswalks/](crosswalks/) for the full mappings, and
[docs/writeups/](docs/writeups/) for full technical write-ups on
individual records.
Expand Down Expand Up @@ -140,11 +140,11 @@ skill file -> in CI / pre-commit -> before deploy

| | |
|---|---|
| Total records | 87 |
| Total records | 88 |
| Schema version | 1.1.0 |
| AIVSS spec | v0.8 |
| CRITICAL (>= 9.0) | 1 |
| HIGH (7.0-8.9) | 19 |
| HIGH (7.0-8.9) | 20 |
| MEDIUM (4.0-6.9) | 65 |
| LOW (< 4.0) | 2 |
| Framework: OWASP MCP Top 10 | all records |
Expand Down Expand Up @@ -208,7 +208,7 @@ AIVSS = ((8.5 + 7.5) / 2) x 1.0 x 1 = 8.0 -> HIGH
## Record index

<details>
<summary><strong>87 records, click to expand</strong></summary>
<summary><strong>88 records, click to expand</strong></summary>

| AVE ID | Title | AIVSS | Severity |
|---|---|---|---|
Expand Down Expand Up @@ -299,6 +299,7 @@ AIVSS = ((8.5 + 7.5) / 2) x 1.0 x 1 = 8.0 -> HIGH
| [AVE-2026-00085](records/AVE-2026-00085.json) | Collusive cross-skill composition: a malicious workflow split across independently benign skills | 7.1 | HIGH |
| [AVE-2026-00086](records/AVE-2026-00086.json) | Mid-session WebMCP tool hijacking: a live registry swap replaces an already-discovered tool under its own name | 7.0 | HIGH |
| [AVE-2026-00087](records/AVE-2026-00087.json) | Agentjacking: a crafted tool response visually mimics a trusted system template to hijack an agent | 7.8 | HIGH |
| [AVE-2026-00088](records/AVE-2026-00088.json) | Sandbox side-effect trust handoff: an agent-written workspace file is run by a trusted component outside the sandbox | 6.4 | MEDIUM |

</details>

Expand Down
Loading
Loading