AIKIDO-2026-163306
nono is vulnerable to Information Exposure
33
Low Risk
This Affects:
nonoTL;DR
The bundled filtering proxy resolves a requested hostname through DNS before it checks the name against the configured allow and deny lists. A process running inside the sandbox can request resolution of a crafted name for a denied domain, so the lookup reaches externally controlled nameservers and the queried label can encode data. This turns DNS into a side channel that leaks information out of the sandbox even when direct connections to the denied host are blocked. The fix checks the hostname allowlist before performing any DNS resolution so disallowed names are never resolved.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on the bundled proxy's hostname allow/deny list to constrain sandboxed network access. Exploitation requires code already running inside the sandbox that can influence the hostname passed to the proxy.
Background info
nono is vulnerable to Information Exposure in versions 0.0.1 - 0.73.0.
How to fix this
Upgrade the nono library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant