Pin host writes to sandbox root
fix(openshell): pin host writes to sandbox root (#69797)
Pin host writes to sandbox root7be82d-fix-pin-host-writes-to-sandbox-root-cve-2026-44112fixpin host writes sandbox root openshell
Committed by drobison00
commit message
fix(openshell): pin host writes to sandbox root (#69797)
* fix(openshell): pin host writes to sandbox root
* fix(openshell): use plugin sdk infra runtime
* fix(openshell): reject symlink write targets
* chore(changelog): note openshell sandbox write fixEditor assessment
This commit patches CVE-2026-44112. The header pin host writes to sandbox root is concise, the openshell scope is accurate, and the squash list shows the substantive steps: pinning writes to the sandbox root, switching to the plugin SDK runtime, and rejecting symlink write targets. Those bullets are commit titles, however, so the reader still has to infer the escape scenario and why symlinked targets were the dangerous case. No body paragraph states the impact or how the root pinning is enforced. The change is security-relevant and clearly not trivial, yet the message reads as release bookkeeping. Accurate but thin, it communicates the shape of the fix without teaching the vulnerability.