{"items":[{"id":"NVI-00018344","kind":"vulnerability","title":"BoxLite has a Timeout Bypass Vulnerability","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xjhv-pp2r-6f82","CVE-2026-47213"],"plain_summary":"GitHub lists this reviewed advisory for boxlite. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-13bc750bb9bb334a056fd2e40dadd9ea"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-11T14:07:13.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-13bc750bb9bb334a056fd2e40dadd9ea"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-13bc750bb9bb334a056fd2e40dadd9ea","url":"https://github.com/advisories/GHSA-xjhv-pp2r-6f82","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xjhv-pp2r-6f82","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T15:13:13.153Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-13bc750bb9bb334a056fd2e40dadd9ea"],"technology":"boxlite","known_exclusions":[],"conditions_summary":"#### Summary\n\nBoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI containers within them. BoxLite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, BoxLite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, BoxLite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the BoxLite service.\n\n#### Details\n\n1. ExecRequest with timeout_ms arrives at Execution service\n\n**File:** `guest/src/service/exec/mod.rs` **Function:** `spawn_execution()` (line 315) **Code:**\n\n```rust\n// Step 3: Start timeout watcher (if requested)\nif req.timeout_ms > 0 {\n    timeout::start_timeout_watcher(\n        state,\n        execution_id.clone(),\n        std::time::Duration::from_millis(req.timeout_ms),\n    );\n}\n```\n\n**Issue:** Any nonzero `timeout_ms` triggers the timeout watcher. The host expects this to kill the process after the specified duration.\n\n2. ","public_affected_ranges":["<= 0.8.2"]}],"null_published_at":"2026-11-07T07:07:39.819Z","source_updated_at":"2026-06-11T14:07:13.000Z","source_disclosed_at":"2026-05-29T21:45:55.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T15:13:13.153Z"}],"next_cursor":null,"snapshot_revision":"42594"}