ENDOR-VUL-2026-0105

Description: DifySandbox's per-request bootstrap (prescript.py and prescript.js) interpolates a server-supplied preload string and runs it before calling the loader that installs the seccomp filter, chroots into the sandbox tree, and drops to a non-root UID. Every control the sandbox has arrives in one call, after the attacker's string has already executed. With enable_preload true, any caller reaching POST /v1/sandbox/run with a valid X-Api-Key gets code execution as container-root with no syscall filter, no chroot, and the full Docker default capability set. Confirmed against dify-sandbox:0.2.15 with euid = 0, NoNewPrivs: 0, and a read of /etc/shadow from the preload phase.

The escalation that makes this more than a container-root bug: overwriting python.so, which every subsequent run loads through ctypes.CDLL, gives persistent root execution over all future runs on that container, including other tenants', until the container is rebuilt. Containers reachable on ssrf_proxy_network (the Dify api and worker) are in scope too, and the stock compose API key is the well-known dify-sandbox.

Impact: Sandbox Escape to persistent container-root execution, cross-tenant.

Dify closed the report as working-as-designed and declined a one-line reorder that would arm the sandbox before the preload runs. No advisory was assigned, no CVSS was scored by the vendor, and no patch is planned, so the compensating controls are the fix: set enable_preload=false, override the default SANDBOX_API_KEY, keep the sandbox off any network reachable by attacker-controlled callers, and do not publish port 8194 on the host, which the developer docker-compose.middleware.yaml does through its squid reverse-proxy entry. Full analysis is in the technical whitepaper.