The default mode has no shell, but client-controlled mode selection reaches a broader backend. Virtual filesystem path scoping does not constrain that shell, and the reported construction supplies no approval gate. Mechanism, preconditions and effects. JoySafeter's client-controlled WebSocket mode switches between a default deepagents path without shell…
Inspect the ClaimsCase · DiggingBeagle record
JoySafeter client-selected Copilot mode reaches an unsandboxed host shell
Scope
Authenticated tenant access to the described Copilot WebSocket routing and standard backend.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
CLM-JOYSAFETER-MODE-SHELL reports: The JoySafeter advisory reports that an authenticated tenant can select standard Copilot mode, whose backend automatically supplies an execute tool running shell=True on the server host. Source SRC-2026-RADAR-JOYSAFETER-MODE-SHELL is located at 'Root Cause; FilesystemSandboxBackend, FilesystemMiddleware and _get_copilot_stream'. The distinctive mechanism begins: JoySafeter's client-controlled WebSocket mode switches between a default deepagents path without shell access and an explicit standard Copilot backend. Classification: setting=research_demonstration, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Disable or isolate standard mode for untrusted tenants, make executable backends explicitly authorized, and require approval before host commands. A filesystem tool allowlist is not sufficient if the middleware adds a separate shell tool. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-JOYSAFETER-MODE-SHELL · JoySafeter CVE-2026-109443 standard-mode advisory
At a glance
No verified production exploitation, corrected version or host configuration prevalence.
Limits and uncertaintyFull account
The default mode has no shell, but client-controlled mode selection reaches a broader backend. Virtual filesystem path scoping does not constrain that shell, and the reported construction supplies no approval gate.
Mechanism, preconditions and effects. JoySafeter's client-controlled WebSocket mode switches between a default deepagents path without shell access and an explicit standard Copilot backend. In the latter, a filesystem backend implementing SandboxBackendProtocol automatically causes an execute tool to appear; that tool calls subprocess.run with shell=True on the server host rather than inside a confined virtual filesystem. An authenticated tenant can select the mode and request commands without a human approval gate.
Comparison and evidence limits. virtual_mode=True scopes file tools but not the direct shell process, so virtual paths do not supply host isolation. The safer default mode is not evidence that the client cannot choose the dangerous mode. The advisory's local canary execution demonstrates an exposed authority boundary; it does not enumerate production tenants exploited.
Claims & evidence
CLM-JOYSAFETER-MODE-SHELLThe JoySafeter advisory reports that an authenticated tenant can select standard Copilot mode, whose backend automatically supplies an execute tool running shell=True on the server host.supported
Basis: reported finding
- supportsJoySafeter CVE-2026-109443 standard-mode advisoryprimary disclosure
Root Cause; FilesystemSandboxBackend, FilesystemMiddleware and _get_copilot_stream
Controls and mitigations
- Disable or isolate standard mode for untrusted tenants, make executable backends explicitly authorized, and require approval before host commands. A filesystem tool allowlist is not sufficient if the middleware adds a separate shell tool.
Unknowns and contradictions
- No verified production exploitation, corrected version or host configuration prevalence.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183