Daily Vulnerability Scan – 2026-05-27

[boxcee-interview]

Scan Summary

• Date: 2026-05-27
• Branch: main
• Head SHA: ede98e3
• Functions analyzed: 150
• Total findings: 1 (high severity)

High Severity

CWE-78 / CWE-94: Command injection via SandboxRequest.command in run_sandbox

• File: src/codex_plugin_scanner/guard/runtime/sandbox.py
• Function: run_sandbox (lines 217–328)
• Issue: User-provided SandboxRequest.command is used to construct subprocess arguments. If untrusted input reaches command (via API/plugin), an attacker can control the executed command, causing remote code execution.
• Mitigation: Enforce allowlist for commands, validate/sanitize SandboxRequest.command, use explicit argv lists only, run sandboxed process as non-root with minimal capabilities.