Protection Mechanism Failure Affecting nono-py package, versions [0.9.0,0.10.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-NONOPY-17675237
- published29 Jun 2026
- disclosed26 Jun 2026
- creditUnknown
Introduced: 26 Jun 2026
CVE NOT AVAILABLE CWE-693 (opens in a new tab)How to fix?
Upgrade nono-py to version 0.10.1 or higher.
Overview
nono-py is a Python bindings for nono capability-based sandboxing
Affected versions of this package are vulnerable to Protection Mechanism Failure in the sandboxed_exec process when running on Linux kernels lacking Landlock network support. An attacker can access sensitive network resources and potentially retrieve cloud metadata credentials by bypassing proxy enforcement through removal of proxy environment variables or use of raw sockets. This is only exploitable if the runtime is Linux, the kernel does not support Landlock network rules (pre-6.7), sandboxed_exec() is used, the capability set applies proxy_only(), and the child process removes or ignores proxy environment variables or uses raw sockets.