Sandbox Escalation in ByteDance verl 0.7.0
CVE-2026-6878 Published on April 23, 2026
ByteDance verl grader.py math_equal sandbox
A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Timeline
Advisory disclosed
VulDB entry created
VulDB entry last update
Weakness Types
Privilege Issues
Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.
Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Affected Versions
ByteDance verl:- Version 0.1 is affected.
- Version 0.2 is affected.
- Version 0.3 is affected.
- Version 0.4 is affected.
- Version 0.5 is affected.
- Version 0.6 is affected.
- Version 0.7.0 is affected.