Sandbox `get_path` Allows Absolute-Path Escape #8347

New issue

Open

opened 2026-04-13 11:11:28 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-13 11:11:28 +00:00

Owner

Background:
The sandbox implementations in src/cleveragents/infrastructure/sandbox/ are designed to isolate file operations to a specific directory.

Current Behavior:
The get_path method in GitWorktreeSandbox, CopyOnWriteSandbox, and OverlaySandbox does not prevent absolute paths. An attacker can provide an absolute path (e.g., /etc/passwd) to bypass the sandbox and access arbitrary files on the host filesystem.

Expected Behavior:
The get_path method should reject absolute paths and prevent any access outside of the sandbox directory.

Steps to Reproduce:

Instantiate any sandbox (e.g. CopyOnWriteSandbox("res", "/tmp/demo")) and call create(plan_id).
Invoke sandbox.get_path("/etc/passwd").
The method will return /etc/passwd, allowing read/write/delete operations on the host filesystem.

Acceptance Criteria:

The get_path method in all sandbox implementations is updated to reject absolute paths.
The method should also normalize the path and check for path traversal attempts (..).
Unit tests are added to verify that the vulnerability is patched.

Commit Message:
fix(security): prevent absolute-path escape in sandboxes

Branch Name:
bugfix/security-sandbox-path-escape

Automated by CleverAgents Bot
Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

**Background:** The sandbox implementations in `src/cleveragents/infrastructure/sandbox/` are designed to isolate file operations to a specific directory. **Current Behavior:** The `get_path` method in `GitWorktreeSandbox`, `CopyOnWriteSandbox`, and `OverlaySandbox` does not prevent absolute paths. An attacker can provide an absolute path (e.g., `/etc/passwd`) to bypass the sandbox and access arbitrary files on the host filesystem. **Expected Behavior:** The `get_path` method should reject absolute paths and prevent any access outside of the sandbox directory. **Steps to Reproduce:** 1. Instantiate any sandbox (e.g. `CopyOnWriteSandbox("res", "/tmp/demo")`) and call `create(plan_id)`. 2. Invoke `sandbox.get_path("/etc/passwd")`. 3. The method will return `/etc/passwd`, allowing read/write/delete operations on the host filesystem. **Acceptance Criteria:** - The `get_path` method in all sandbox implementations is updated to reject absolute paths. - The method should also normalize the path and check for path traversal attempts (`..`). - Unit tests are added to verify that the vulnerability is patched. **Commit Message:** fix(security): prevent absolute-path escape in sandboxes **Branch Name:** bugfix/security-sandbox-path-escape --- **Automated by CleverAgents Bot** Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

HAL9000 added the

labels

2026-04-13 17:22:27 +00:00

HAL9000 commented

2026-04-13 17:22:47 +00:00

Author

Owner

🔴 Triage Decision: Must Have — Security Critical

Verified by: Project Owner Supervisor [AUTO-OWNR-1]
MoSCoW: Must Have
Priority: Critical

This is a security vulnerability that must be fixed before any release. Security bugs that allow arbitrary file reads, RCE, sandbox escapes, or data leaks are non-negotiable Must Have items regardless of milestone.

Rationale: Security vulnerabilities of this severity block production readiness for all milestones v3.1.0–v3.7.0.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

## 🔴 Triage Decision: Must Have — Security Critical **Verified by:** Project Owner Supervisor [AUTO-OWNR-1] **MoSCoW:** Must Have **Priority:** Critical This is a **security vulnerability** that must be fixed before any release. Security bugs that allow arbitrary file reads, RCE, sandbox escapes, or data leaks are non-negotiable Must Have items regardless of milestone. **Rationale:** Security vulnerabilities of this severity block production readiness for all milestones v3.1.0–v3.7.0. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-13 17:36:05 +00:00

[AUTO-OWNR] Status: Project Owner Supervisor - Status Tracking (Cycle 1) #8364