CVE-2026-54319

{
  "id": "CVE-2026-54319",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-23T19:17:07.810",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeId, which may also be a volume name) was forwarded to the runner and used to build the host bind-mount source path without confinement. A reference containing path-traversal sequences could in principle resolve the mount source outside the intended per-volume base directory. This vulnerability is fixed in 0.186."
    },
    {
      "lang": "es",
      "value": "Daytona es un tiempo de ejecución de infraestructura seguro y elástico para la ejecución de código generado por IA y flujos de trabajo de agentes. Antes de 0.186, una referencia de volumen de sandbox (volumeId, que también puede ser un nombre de volumen) se reenviaba al runner y se utilizaba para construir la ruta de origen del bind-mount del host sin confinamiento. Una referencia que contenía secuencias de recorrido de rutas podría en principio resolver el origen del montaje fuera del directorio base por volumen previsto. Esta vulnerabilidad está corregida en 0.186."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "daytonaio",
          "product": "daytona",
          "versions": [
            {
              "version": "< 0.186",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 4.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-24T13:36:26.958408Z",
          "id": "CVE-2026-54319",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-250"
        },
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/daytonaio/daytona/security/advisories/GHSA-fjv8-j4p5-cr9m",
      "source": "[email protected]"
    }
  ]
}