CVE-2026-47128

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

EPSS

0.13% chance of exploitation in the next 30 days, 3th percentile

Published

2026-07-20

Updated

2026-07-21

Proof-of-concept exploits (1)

• advisories/GHSA-27vp-2mmc-vmh3

References

• CVE Record
• NVD entry

Related

• CVE-2026-47124
• CVE-2026-47137
• CVE-2026-47121
• CVE-2026-47139
• CVE-2026-47120
• CVE-2026-47140