Beta9 is vulnerable to a Container Escape via Unvalidated Sandbox File Paths

The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath in pkg/worker/container_server.go turns the tenant's path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9 , the remainder is joined onto that mount's source with filepath.Join , which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root.

Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin.

Worker 0.1.756 opens these paths with os.OpenRoot , so parent-directory and symlink lookups stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution.

Step 1 - Install the client

A workspace token and one sandbox are the credentials a tenant already uses. The proof reads one path two ways and prints decoded token claims. It does not print the token, and it writes nothing.

Step 2 - Save the comparison script

Step 3 - Compare the in-sandbox view with the file API

Expected output on a worker before 0.1.756. The token itself is withheld. The claims name the worker pod, which is a different name from the sandbox:

On worker 0.1.756 or later the same script prints NOT VULNERABLE: the file API returned nothing for the escaped path .

Vulnerability Mitigations

Upgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot , so parent-directory segments and symbolic links stay inside the container root or the mount source.

The change is , commit a28bf12cf0007c792a25d8ed282b4e8bf6f30393, released as worker 0.1.756 on 2026-09-15.