CVE-2018-18748

Severity: critical (CVSS 10.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-10-29 · updated 2026-06-17

Description

Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file. NOTE: the vendor disputes this issue because the observed behavior is consistent with the product's intended functionality

Affected products

sandboxie-plus Sandboxie: 5.26

References

https://github.com/sandboxescape/Sandboxie-5.26-Sandbox-Escape-Exploit/blob/2632a5f7409e52b2e020f5d4467fa019f9095e73/README.doc
https://github.com/sandboxescape/Sandboxie-5.26-Sandbox-Escape-Exploit/
https://github.com/sandboxescape/Sandboxie-5.26-Sandbox-Escape-Exploit/blob/2632a5f7409e52b2e020f5d4467fa019f9095e73/README.doc

Get alerted when CVE-2018-18748 or the next vulnerability affects your stack