{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2025-68668",
    "name": "CVE-2025-68668",
    "vendor": "n",
    "description": "Cyera researchers Vladimir Tokarev and Saar Pearl showed that products relying on Pyodide for sandboxed Python were enforcing their restrictions only at the Python level, while the ctypes module and Emscripten-exported functions offered a path straight into the JavaScript host runtime. The same escape reproduced across workflow automation, spreadsheets, AI agent runtimes, desktop apps and CI tooling: n8n (CVE-2025-68668, 9.9), Cohere Terrarium (CVE-2026-61522, 9.3), Grist (CVE-2026-24002, 9.1), Hugging Face smolagents (CVE-2026-10613, 8.3), plus langchain-sandbox, stlite and cibuildwheel. Maintainer responses diverged sharply: some re-architected, some archived the component, and some held that isolation is the deployer's responsibility.",
    "website": "https://www.esecurityplanet.com/threats/def-con-34-one-pyodide-flaw-exposed-seven-products/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-10",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2025-68668",
      "aliases": [
        "ti-074"
      ],
      "title": "DEF CON 34: One Pyodide Escape Broke the Sandbox in Seven Products at Once",
      "summary": "Cyera researchers Vladimir Tokarev and Saar Pearl showed that products relying on Pyodide for sandboxed Python were enforcing their restrictions only at the Python level, while the ctypes module and Emscripten-exported functions offered a path straight into the JavaScript host runtime. The same escape reproduced across workflow automation, spreadsheets, AI agent runtimes, desktop apps and CI tooling: n8n (CVE-2025-68668, 9.9), Cohere Terrarium (CVE-2026-61522, 9.3), Grist (CVE-2026-24002, 9.1), Hugging Face smolagents (CVE-2026-10613, 8.3), plus langchain-sandbox, stlite and cibuildwheel. Maintainer responses diverged sharply: some re-architected, some archived the component, and some held that isolation is the deployer's responsibility.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Sandbox escape"
      ],
      "componentType": "agent",
      "component": {
        "name": "n",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "n8n (CVE-2025-68668), Grist (CVE-2026-24002), Cohere Terrarium (CVE-2026-61522), Hugging Face smolagents (CVE-2026-10613), langchain-sandbox, stlite, cibuildwheel",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-10",
      "modifiedAt": "2026-08-10",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.esecurityplanet.com/threats/def-con-34-one-pyodide-flaw-exposed-seven-products/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68668"
        }
      ],
      "mitigation": "Patch each affected product to its fixed release, and where the maintainer declined to fix, stop counting Pyodide as an isolation boundary at all. Any agent runtime that executes model-generated Python inside Pyodide needs a real boundary underneath it: an ephemeral container, no ambient cloud credentials in the process, and restricted outbound network.",
      "detectedByAnomity": true
    }
  }
}