CVE-2026-6878

BRIEFING NOTE CVE-2026-6878 affects ByteDance verl versions up to 0.7.0 and involves a sandbox bypass vulnerability in the math_equal function within prime_math/grader.py. This flaw allows attackers to escape the intended sandboxed environment, potentially compromising system integrity and data confidentiality. The vulnerability has a CVSS 3.1 score of 5.6 (MEDIUM severity) with a network-based attack vector that requires high complexity and no user interaction. The attack can result in limited impacts to confidentiality, integrity, and availability of the affected system. While exploitability is classified as difficult, a public exploit is available, elevating practical risk. The vulnerability is currently listed on CISA's KEV catalog as actively exploited in the wild, indicating real-world attack activity. Despite early vendor notification, ByteDance has not provided a response or patch, leaving users without official mitigation. Organizations running affected verl versions should prioritize evaluation of the public exploit and consider implementing compensating controls or version upgrades when available.