CVE-2026-47213

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.

• CWE-404

• https://github.com/boxlite-ai/boxlite/commit/28159fc5b6b6fd5037e18a58fc4644c882e3c581
• https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82
• https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82

Published

Jun 10, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47208vm2 is an open source vm/sandbox for Node.js. Prior to versi…10
• CVE-2026-47209vm2 is an open source vm/sandbox for Node.js. Prior to versi…8.6
• CVE-2026-4721Memory safety bugs present in Firefox ESR 115.33, Firefox ES…9.8
• CVE-2026-47210vm2 is an open source vm/sandbox for Node.js. Prior to versi…9.8
• CVE-2026-47211Ouroboros is a local-first runtime for AI coding agents that…8.4
• CVE-2026-47212Symfony is a PHP framework for web and console applications …5.3
• CVE-2026-47214Docling simplifies document processing by parsing diverse fo…7.1
• CVE-2026-47216Typesense is a fast, typo-tolerant search engine. Prior to v…8.7
• CVE-2026-47219find-my-way is a framework-independent HTTP router that inte…7.5
• CVE-2026-4722Privilege escalation in the IPC component. This vulnerabilit…8.8
• CVE-2026-47220Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-47221Envoy is an open source edge and service proxy designed for …7.5