{"id":"CVE-2026-47128","sourceIdentifier":"security-advisories@github.com","published":"2026-07-20T22:17:14.847","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue."},{"lang":"es","value":"nono es un software que permite a los usuarios ejecutar agentes de IA en una sandbox de latencia cero. Antes de la versión 0.55.0, las políticas Landlock/seccomp de nono permiten el acceso a sockets de dominio Unix locales (concretos y abstractos). Esto permite un escape fácil de la sandbox al comunicarse con el socket dbus de systemd por usuario. La versión 0.55.0 corrige el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"always-further","product":"nono","versions":[{"version":"< 0.55.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-21T12:56:24.647616Z","id":"CVE-2026-47128","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/nolabs-ai/nono/security/advisories/GHSA-27vp-2mmc-vmh3","source":"security-advisories@github.com"},{"url":"https://github.com/nolabs-ai/nono/security/advisories/GHSA-27vp-2mmc-vmh3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}