GHSA-57xf-95mj-j6j6: 
Rust vulnerability analysis and mitigation

Found in an internal audit on 2026-10-21. Fixed in 0.2.0-preview.5; upgrade to it.

What was found (up to 0.2.0-preview.4)

• In Network::Proxy and Network::Allow, the Seatbelt profile denies only network-outbound (remote ip); it never denies network-bind (crates/kule-engine/src/sandbox.rs). Deny mode does add (deny network-bind (local ip)). Reproduced: a compiled binary binding 0.0.0.0:18080 and listening succeeds under a proxy-mode profile, fails under deny mode. The only guard is the interpreter hooks (NODE_OPTIONS, PYTHONPATH, RUBYOPT), which the agent controls: python3 -S skips sitecustomize.py (reproduced).
• isolation::isolation_gaps is Linux-only, so neither this nor the shared /tmp (writable via Sandbox::for_task, no mount namespace on macOS) is shown to the person. Docs and loopback.rs claim nothing an agent runs answers the network past the proxy. Measured during the fix: Seatbelt's network-bind and network-inbound filters see only the port. (local ip "localhost:*") matches binds on 0.0.0.0, :: and the LAN address too, so loopback-only binding cannot be expressed. The macOS shield, which looks from outside every 50 ms, runs only while an agent runs in the app.

Fix

Fixed in 0.2.0-preview.5.

• In Network::Proxy on macOS, the Seatbelt profile denies network-bind (local ip) unless the new servers limit allows it. The limit is off by default and can be set for every task, a group or one task, in Settings → Limits or with kule limits servers=on.
• With servers allowed, isolation_gaps reports it on macOS, so commands run only once the person accepts weaker isolation.
• A refused bind is listed after the command, with how to allow it.
• /tmp is no longer writable on macOS. TMPDIR, TMPPREFIX (zsh) and CLAUDE_CODE_TMPDIR point at the task's tmp, and a refused /tmp write says to use $TMPDIR.
• Docs and the loopback/shield comments say what holds servers off the network.
• --open-network (Network::Allow), which bypasses the proxy and the policy by the person's explicit choice, is unchanged.

Tests (seen failing first)

• servers_listen_on_macos_only_where_the_task_allows_them: under a proxy-mode sandbox, python3 -S (no hook) cannot bind 0.0.0.0, ::, 127.0.0.1 or UDP. With servers=on, the command is refused until weaker isolation is accepted, and then binds.
• tmp_is_the_tasks_own_or_closed: a write to /tmp/x is refused on macOS (and still works in Linux's own /tmp), and $TMPDIR, TMPPREFIX and CLAUDE_CODE_TMPDIR point at the task's tmp.
• servers_on_macos_are_a_gap_only_where_the_proxy_holds_the_network, a_refused_server_or_tmp_write_says_what_to_do.
• Manually: a python3 -S bind under kule exec is refused with the hint; Claude Code runs under kule run with /tmp closed.

Workaround

Upgrade to 0.2.0-preview.5. On an older version, use kule exec --no-network for untrusted commands on macOS, and keep files other programs read out of /tmp while tasks run.