The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.
"}]}],"references":[{"url":"https://github.com/beam-cloud/beta9","name":"Beta9 repository","tags":["product"]},{"url":"https://github.com/beam-cloud/beta9/pull/1897","name":"Handle sandbox edge cases (fix pull request)","tags":["patch"]},{"url":"https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393","name":"Fix commit a28bf12","tags":["patch"]},{"url":"https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756","name":"worker-0.1.756","tags":["release-notes"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"Tenant with a workspace token and a running sandbox on a worker that serves the sandbox file API"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.9,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"solutions":[{"lang":"en","value":"Upgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15.","supportingMedia":[{"type":"text/html","base64":false,"value":"Upgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15.
"}]}],"timeline":[{"time":"2026-09-15T04:03:00.000Z","lang":"en","value":"Fix merged in pull request 1897 (commit a28bf12)"},{"time":"2026-09-15T04:03:00.000Z","lang":"en","value":"Fixed release worker-0.1.756 published. No vendor security advisory was filed with the pull request."}],"credits":[{"lang":"en","value":"Natan Nehorai","type":"finder"},{"lang":"en","value":"JFrog Security Research","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}