CVE-2026-54319
MEDIUM EPSS 6.8%
Published Jun 23, 20261w ago · Modified Jun 24, 20261w ago
4.2 CVSS 3.1
Published Jun 23, 2026 1w ago
Last Modified Jun 24, 2026 1w ago
Description
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeId, which may also be a volume name) was forwarded to the runner and used to build the host bind-mount source path without confinement. A reference containing path-traversal sequences could in principle resolve the mount source outside the intended per-volume base directory. This vulnerability is fixed in 0.186.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
6.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 3
CWE-22 Path Traversal Resource Mgmt
CWE-250
CWE-269 Improper Privilege Management Authorization
References 1
- github.com https://github.com/daytonaio/daytona/security/advisories/GHSA-fjv8-j4p5-cr9m
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.