PT-2026-45035 · Boxlite Ai+1 · Blox Lite

Published 2026-05-29 · Updated 2026-06-11 · CVE-2026-47213

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Boxlite versions 0.8.2 and earlier

Description Boxlite is a sandbox service that enables the creation of lightweight virtual machines to run untrusted code within OCI containers. The service allows users to configure a timeout for processes running inside these virtual machines. When a timeout is reached, the system is intended to terminate the process. However, the implementation uses the SIGALRM signal instead of the uncatchable SIGKILL signal. Because SIGALRM can be caught or ignored by the process, malicious code can bypass the timeout restriction and continue executing. This can lead to resource exhaustion within the virtual machine and impact the overall availability of the service. The issue is located in the start timeout watcher() function within the guest/src/service/exec/timeout.rs file, where the timeout ms variable triggers the delivery of the incorrect signal.

Recommendations Update Boxlite to a version that incorporates commit 28159fc to ensure the SIGKILL signal is used for process termination upon timeout.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2026-47213

GHSA-XJHV-PP2R-6F82

Affected Products

Blox Lite

References · 7

• 🔥 https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82 · Exploit
• https://osv.dev/vulnerability/GHSA-xjhv-pp2r-6f82 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47213 · Security Note
• https://github.com/boxlite-ai/boxlite/commit/28159fc5b6b6fd5037e18a58fc4644c882e3c581 · Note
• https://github.com/boxlite-ai/boxlite · Note
• https://twitter.com/VulmonFeeds/status/2064981625104978076 · Twitter Post
• https://t.me/CVEtracker/56508 · Telegram Post