RUSTSEC-2026-0147: Read-only volume remount bypass via guest CAP_SYS_ADMIN

What to do

1. See which version you have: cargo tree -i boxlite (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p boxlite. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example boxlite = "0.9.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of boxlite mount host directories shared via virtiofs as guest-side read-only by setting MS_RDONLY from the guest. Because the default guest capability set included CAP_SYS_ADMIN, untrusted code running inside a sandbox could execute mount -o remount,rw <path> to re-flag the share as read-write and then write through to the host filesystem , fully escaping the read-only contract boxlite advertised to callers.

The fix in v0.9.0 enforces read-only at the hypervisor level via krun_add_virtiofs3 (so the guest's MS_RDONLY is no longer the authoritative gate) and drops CAP_SYS_ADMIN from the default guest capability set (matching Docker's defaults).

This is a sandbox-escape bug: boxlite is a sandboxing runtime, so the read-only invariant is part of its security contract. CVSS rated 10.0 by the upstream advisory.

References

• Package: crates.io/crates/boxlite
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0147.html
• Web: github.com/boxlite-ai/boxlite/pull/454
• Web: github.com/boxlite-ai/boxlite/pull/454

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for boxlite

• Vulnerability CriticalRUSTSEC-2026-0148 · 2026-05-16OCI layer symlink escape → arbitrary host write

Full security history of boxlite