Firejail is a lightweight sandboxing and privilege-isolation utility used to restrict the execution environment of desktop and server applications, a specialized but strategically important tool in application confinement. Vulnerabilities affecting the project skew toward serious outcomes and recur through privilege-management and command-injection weakness classes that undermine the sandbox boundary itself—including improper privilege escalation, argument injection, and OS command injection—making each flaw a potential full bypass of the intended isolation. Defenders deploying Firejail should treat advisories as high-priority sandbox-integrity issues and monitor for exploitation activity; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Firejail Project over time
Signals from CVEs in this vendor scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-5180HIGH Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which | Feb 9, 2017 | 8.8 | 37 | NO | YES |
CVE-2017-5206CRITICAL Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debug | Mar 23, 2017 | 9.0 | 30 | NO | NO |
CVE-2017-5940HIGH Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zer | Feb 9, 2017 | 8.8 | 27 | NO | NO |
CVE-2022-31214HIGH A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a jo | Jun 9, 2022 | 7.8 | 26 | NO | NO |
CVE-2019-12589HIGH In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter | Jun 3, 2019 | 8.8 | 26 | NO | NO |
CVE-2020-17368CRITICAL Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection. | Aug 11, 2020 | 9.8 | 25 | NO | NO |
CVE-2019-12499HIGH Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminat | May 31, 2019 | 8.1 | 25 | NO | NO |
CVE-2017-5207HIGH Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument. | Mar 23, 2017 | 7.8 | 25 | NO | NO |
CVE-2021-26910HIGH Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation. | Feb 8, 2021 | 7.0 | 23 | NO | NO |
CVE-2016-10123HIGH Firejail allows --chroot when seccomp is not supported, which might allow local users to gain privileges. | Apr 13, 2017 | 7.8 | 23 | NO | NO |
Signals from CVEs in this vendor scope (18 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Firejail Project.
Media articles that mention a CVE ID that affects a product developed by Firejail Project — matched by CVE ID, not by vendor name.