Root-Rce — PoC Archivehttps://poc.intelseclab.com/tags/root-rce/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000LiteLLM Guardrail Custom-Code Sandbox Escape to Root RCE (CVE-2026-40217)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40217-litellm-guardrail-sandbox-escape/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40217-litellm-guardrail-sandbox-escape/Critical severity (CVSS 8.8) — web · CVE-2026-40217 (X41-2026-001, GHSA-3926-2jvf-fg29). Status: PoC. Affects: LiteLLM (open-source LLM proxy/gateway), POST /guardrails/test_custom_code endpoint. Tags: litellm, llm-proxy, sandbox-escape, bytecode-manipulation, cwe-913, docker, root-rce, authenticated.webCriticallitellmllm-proxysandbox-escapebytecode-manipulationcwe-913dockerroot-rceauthenticatedFortiSandbox 4.4.0-4.4.8 — OS Command Injection via tracer-behavior Endpoint (CVE-2026-39808)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-39808-fortisandbox-os-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-39808-fortisandbox-os-command-injection/Critical severity (CVSS 9.8) — network · CVE-2026-39808. Status: Weaponized — real, working exploit verified from two independent sources. Affects: Fortinet FortiSandbox. Tags: fortinet, fortisandbox, os-command-injection, unauthenticated, root-rce, cwe-78, actively-exploited, kev.networkCriticalfortinetfortisandboxos-command-injectionunauthenticatedroot-rcecwe-78actively-exploitedkev