CVE-2026-47128: 
Rust vulnerability analysis and mitigation

CVE-2026-47128 is a sandbox escape vulnerability in the nono Rust CLI tool (package nono-cli) affecting all versions prior to 0.55.0. The flaw exists in nono's Landlock/seccomp sandbox policies, which fail to restrict access to local Unix domain sockets (both concrete and abstract), enabling a sandboxed process to communicate with the per-user systemd D-Bus socket and escape confinement. It was first published by maintainer lukehinds on May 17, 2026, and added to the GitHub Advisory Database on May 28, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Moderate) (Github Advisory, Nono Advisory).

The root cause is incomplete mediation of local Unix domain socket access within nono's bundled sandbox profiles and CLI policy layer (CWE-863: Incorrect Authorization). The Landlock/seccomp policies applied by nono do not block access to Unix domain sockets, allowing a sandboxed process to reach the per-user systemd D-Bus socket. An attacker or AI agent operating within the sandbox can invoke systemd-run --user via D-Bus to spawn an unsandboxed sibling process that inherits the full permissions of the launching user. A public reproducer is available: running nono run -s --allow-cwd --profile claude-code -- systemd-run --user -q --wait --collect /bin/sh -c 'echo oops > ~/Documents/escaped.txt' demonstrates the escape (Github Advisory, Nono Advisory).

Successful exploitation results in a complete sandbox escape: the unsandboxed sibling process spawned via D-Bus can write to any location the launching user has write access to, spawn arbitrary processes with full network access, and perform any action within the user's authority. Importantly, the vulnerability does not provide privilege escalation, cross-user access, or host-level compromise beyond the permissions already held by the invoking user. The primary risk is that an AI agent or untrusted command stream (e.g., Aider, Claude Code, OpenCode) operating under an "allow bash" policy could be tricked into abusing this bypass to perform unauthorized or destructive actions on behalf of the user (Github Advisory, Nono Advisory).

1. Precondition: Gain execution within a nono sandbox (e.g., by being an AI agent like Aider, Claude Code, or OpenCode running under an "allow bash" or similar policy that permits invoking host tools).
2. Identify D-Bus socket access: Confirm that the sandbox policy does not restrict Unix domain socket access — nono versions < 0.55.0 do not block these by default.
3. Invoke systemd-run via D-Bus: Execute systemd-run --user -q --wait --collect /bin/sh -c '<payload>' from within the sandboxed process. This communicates with the per-user systemd D-Bus socket to spawn an unsandboxed sibling process.
4. Execute arbitrary commands: The sibling process runs outside the sandbox with the full permissions of the launching user, allowing file writes, process spawning with network access, or other destructive actions.
   • Example: nono run -s --allow-cwd --profile claude-code -- systemd-run --user -q --wait --collect /bin/sh -c 'echo oops > ~/Documents/escaped.txt' (Github Advisory, Nono Advisory).

• Process: Unexpected systemd-run --user invocations spawned as child processes of a nono-sandboxed process; unsandboxed /bin/sh or other shell processes appearing as children of systemd user instance without direct user initiation.
• Logs: systemd user journal entries (journalctl --user) showing transient units created unexpectedly (e.g., run-*.service) at times correlating with nono sandbox sessions.
• File System: Unexpected file modifications or new files in user home directories (e.g., ~/Documents/) created during or shortly after nono sandbox sessions.
• Network: Outbound network connections initiated by processes spawned under the user's systemd session that are not attributable to known user activity, particularly during AI agent coding sessions (Github Advisory).

Upgrade nono-cli to version 0.55.0 or later, which adds support for restricting Unix domain socket access within sandbox policies. The fix addresses the root cause by implementing proper mediation of local Unix domain socket access in the affected CLI policy layer and bundled sandbox profiles. Note that the underlying core nono library and language SDKs are not affected, as they do not ship with policy definitions by default. Until patching is possible, avoid running AI coding agents (Aider, Claude Code, OpenCode, etc.) with "allow bash" or similar permissive policies under nono on systems where the user's D-Bus socket is active (Github Advisory, Nono Advisory).

The advisory was published by maintainer lukehinds and credits cgwalters as reporter and NickCao as a contributor. The maintainer's context note emphasizes that while the sandbox escape is serious — particularly in AI agent workflows — it does not constitute privilege escalation or cross-user compromise, framing it as a blast-radius reduction failure rather than a full system compromise. No significant broader media coverage or social media discussion has been identified at this time (Github Advisory, Nono Advisory).