GHSA-pxhw-h44j-8pfx reproduction summary
date: 2026-08-26T20:12:50+00:00
vulnerable_commit: 9ca3b05ec787acfb4b17bed37db5719fa777834f (v0.11.0)
fixed_commit: 2a76602a8c71f36c1527cf9fc3417d9149822e0c (v0.12.0)
marker_content: BWRAP_OLDROOT_ESCAPE_20260826T201250Z
bwrap-vuln sha256: 82f1194f4fcd4bf369bff712e100610027290821a6aa4f5c2be47d7000609a02
bwrap-fixed sha256: 4d7e2b7d529371e083d0a71a3830efc0d4fef7e9cbd28cb37538ecac2580de85

attempt-vuln-1: exit=0 host_dir=present host_marker=present marker_content_match=yes => ESCAPE_CONFIRMED (host dir + attacker-controlled marker file created outside sandbox)
attempt-vuln-2: exit=0 host_dir=present host_marker=present marker_content_match=yes => ESCAPE_CONFIRMED (host dir + attacker-controlled marker file created outside sandbox)
attempt-fixed-1: exit=1 host_dir=absent host_marker=absent marker_content_match=no => CONTAINED (fixed build failed closed, nothing created on host)
attempt-fixed-2: exit=1 host_dir=absent host_marker=absent marker_content_match=no => CONTAINED (fixed build failed closed, nothing created on host)

VERDICT: CONFIRMED - GHSA-pxhw-h44j-8pfx reproduced (v0.11.0 escapes to host, v0.12.0 contained)