always-further nono up to 0.54.x landlock sandbox

Summaryinfo

A vulnerability, which was classified as problematic, has been found in always-further nono up to 0.54.x. Affected by this vulnerability is an unknown functionality of the component landlock. Performing a manipulation results in sandbox. This vulnerability is reported as CVE-2026-47128. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability was found in always-further nono up to 0.54.x. It has been classified as problematic. This affects an unknown functionality of the component landlock. The manipulation with an unknown input leads to a sandbox vulnerability. CWE is classifying the issue as CWE-265. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-47128 since 05/18/2026. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1611 according to MITRE ATT&CK.

Upgrading to version 0.55.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• always-further

Name

• nono

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53
• 0.54

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion