CVE-2026-47128 in nono
Summary
by MITRE • 07/21/2026
nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in question affects nono software versions prior to 0550 which implements sandboxing mechanisms using Landlock and seccomp security policies. These policies are designed to restrict access to system resources and prevent unauthorized operations within the sandboxed environment. However, a critical flaw existed in the policy configuration that permitted access to local Unix domain sockets including both concrete and abstract socket paths. This design oversight created a significant security weakness that could be exploited by malicious actors to bypass the intended sandbox boundaries.
The technical implementation of this vulnerability stems from overly permissive access controls within the Landlock and seccomp policies. Unix domain sockets serve as inter-process communication mechanisms that allow processes to communicate locally on the same system, with systemd dbus being a particularly critical service that handles system-level operations and user session management. When the sandbox policies granted access to these socket paths, they inadvertently provided a pathway for sandboxed applications to interact directly with the per-user systemd dbus socket, which operates with elevated privileges and can execute privileged operations.
The operational impact of this vulnerability is severe as it enables an attacker to perform sandbox escape attacks with minimal complexity. An attacker within the sandboxed environment could establish communication with the systemd dbus socket and potentially execute arbitrary commands with the privileges of the user running the nono process. This represents a complete bypass of the intended security isolation, allowing access to system resources that should remain restricted. The vulnerability is particularly concerning because it requires no special privileges or complex exploitation techniques, making it easily exploitable by anyone with access to the sandboxed environment.
This vulnerability aligns with CWE-276 which addresses improper privileges and CWE-284 which covers inadequate access controls. From an ATT&CK perspective, this represents a privilege escalation technique using service manipulation and process injection methods. The attack vector specifically maps to T1068 - Exploitation for Privilege Escalation and T1566 - Phishing for Information. The mitigation implemented in version 0.55.0 addresses the root cause by tightening the Landlock and seccomp policies to prevent access to Unix domain sockets, thereby restoring proper sandbox isolation. Organizations should ensure immediate deployment of this patch and conduct thorough security reviews of other similar sandboxing implementations that may contain analogous flaws, particularly those involving inter-process communication mechanisms and privileged service access controls.