Containerized LLM Sandboxes Can Still Yield Host Root
Pyodide-based sandboxes can still hand attackers host-level control. The standard response is to trust the container boundary, but CVE-2026-5752 breaks that assumption by letting code reach root privileges through JavaScript prototype traversal.
Cohere’s Terrarium sandbox is affected. CERT/CC says the flaw sits in the Pyodide WebAssembly environment and can let an attacker execute arbitrary system commands as root inside the container, access sensitive files, and potentially escape into the host Node.js process. The issue is rated CVSS 9.3 and requires only local access, not user interaction or special privileges.
The practical risk is broader than one sandbox product. Any workflow that runs untrusted or LLM-generated Python in a containerized Pyodide environment should treat the container as a weak boundary, because host compromise can follow even when the sandbox itself appears isolated.