Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file. NOTE: the vendor disputes this issue because the observed behavior is consistent with the product's intended functionality
| CVE | CVE-2018-18748 |
|---|---|
| Severidad | CRITICAL |
| CVSS | 10.0 / 10 |
| EPSS | 2.4% en 30 días (percentil 84) |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Productos afectados (catálogo NVD)
sandboxie-plus/sandboxie