Skip to content
OpenAdvisories

Package · Go

github.com/daytonaio/daytona

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-54319

    Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape

    Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeId, which may also be a volume name) was forwarded to the runner and used to build the host bind-moun…

    daytonaio daytona github.com/daytonaio/daytona Go
  • Medium 6.5
    CVE-2026-54324

    Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

    Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another …

    daytonaio daytona github.com/daytonaio/daytona Go