PT-2026-40421 · Unknown · Openclaude

Rosayxy · Published 2026-05-12 · Updated 2026-06-02 · CVE-2026-42074

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openclaude versions prior to 0.5.1

Description A security issue exists where the dangerouslyDisableSandbox parameter is exposed within the BashTool input schema. This allows a Large Language Model (LLM), which is considered an untrusted principal, to set this parameter to true in a tool use response. When combined with the default setting allowUnsandboxedCommands: true, a model subject to prompt injection can bypass the sandbox boundary. This enables the execution of arbitrary commands directly on the host system, leading to full host-level code execution. The issue is rooted in the shouldUseSandbox() function, which fails to properly restrict this security-critical flag from model control.

Recommendations Update to version 0.5.1 or later. As a temporary mitigation, set the allowUnsandboxedCommands configuration setting to false to ensure the sandbox remains active regardless of the model's input.

Exploit

Fix

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

CVE-2026-42074

GHSA-M77W-P5JJ-XMHG

Affected Products

Openclaude

References · 7

• 🔥 https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg · Exploit
• https://github.com/Gitlawb/openclaude/commit/aab489055c53dd64369414116fe93226d2656273 · Patch
• https://github.com/Gitlawb/openclaude/pull/778 · Patch
• https://osv.dev/vulnerability/GHSA-m77w-p5jj-xmhg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42074 · Security Note
• https://github.com/Gitlawb/openclaude · Note
• https://twitter.com/UpwindMDR/status/2054238976139989363 · Twitter Post