[masih]

The seidroid/omnigent sandbox runner (omnigent-host:v0.17.0 from runner-base.txt) ships Node v22.23.3, which carries CVE-2026-111497, an out-of-bounds write in the Brotli decoder. The harness CLIs in the sandbox (claude, codex, pi) run on that Node and fetch arbitrary web content, so a malicious server answering with crafted Brotli reaches the decoder. All 9 sandbox pods in the dev cluster run runner-overlay-b79aea1, built on that base. The server image has no Node, so only the runner needs this.

This copies /usr/local/bin/node from node:22.23.4-trixie-slim (same Debian 13 base, pinned by digest) over the base's binary and fails the build if node --version is anything else. Upstream's v0.19.1 already ships 22.23.4, but moving the bases from v0.17.0 means a lockstep server bump with boot-time migrations, so this keeps the release unchanged and can be dropped at the next base bump. A local build on the pinned base passes the credential-bridge check, and node, npm, claude, codex and pi all start. Once ecr-runner.yml publishes the new tag, the runner digest in platform's sandbox-config-patch.yaml and sandbox-image-prepull.yaml needs the bump to reach the cluster.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'Devin'.

• Disable automatic comment, CI, and merge conflict monitoring

[cursor]

PR Summary

Low Risk
Build-time binary swap with version assertions; limited to the runner overlay and intended as a temporary measure until the base image catches up.

Overview
Patches CVE-2026-111497 in the sandbox runner by replacing the base image’s older Node 22.x binary with Node v22.23.4, copied from a digest-pinned node:22.23.4-trixie-slim stage into /usr/local/bin/node.

The Dockerfile adds a guard RUN that fails the build once the upstream base already ships 22.23.4+, so this temporary override is removed instead of pinning an older Node. A follow-up check asserts node --version is exactly v22.23.4 at build time.

This targets harness CLIs (claude, codex, pi) that use Node fetch() and could hit the Brotli decoder RCE; the server image is unchanged. Publishing still goes through the existing runner build workflow, with platform sandbox image digests updated separately after the new tag lands.

^{Reviewed by Cursor Bugbot for commit d2717eb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[seidroid]

The change overwrites the runner's Node binary with a digest-pinned 22.23.4 from the official trixie-slim image, then fails the build if node --version reports anything else. Upstream's v0.17.0 host stage installs Node at the same /usr/local/bin/node path, so the copy replaces the vulnerable binary and does not just shadow it. Nothing blocks; codex's empty reading matches mine, and my one suggestion is about removing the override later.

Non-blocking

1 finding on the changed lines, as inline comments.

_{seidroid review · decision approve · session 45687664226e4574bc39382aa4bd55b7 · turn resp_claude_f516f72a6948aee2dd12821f1d07c991 · item 37ea06b406275f44a778eb98426ac41a}

Findings: 0 blocking | 1 non-blocking | 1 posted inline