CVE-2026-54319: Daytonaio Daytona

Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days.

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeId, which may also be a volume name) was forwarded to the runner and used to build the host bind-mount source path without confinement. A reference containing path-traversal sequences could in principle resolve the mount source outside the intended per-volume base directory. This vulnerability is fixed in 0.186.

Affected products

• Daytonaio Daytona: before 0.186 (fixed in 0.186)

Published 2026-06-23. Last modified 2026-06-24.