Vulnerability Report: Sandbox Escape / Unrestricted Internet Access in Free VPS

[dev3Masud]

Hey

I have identified a security issue regarding the sandbox isolation boundaries in this environment. Specifically, I was able to achieve unrestricted outbound internet access from within the free VPS/sandbox tier, which appears to bypass intended network restrictions.

To demonstrate this behavior, I have uploaded screenshots and screen recordings as proof to the following Google Drive folder:
https://drive.google.com/drive/folders/1IE3eCvex-ztNBLWdZp8jCIQpU1QO6Agw?usp=sharing

Please note that I am a developer practicing responsible disclosure, not a malicious actor. If you need details on how to reproduce or fix this isolation gap, please reply directly to this issue.

[mislavivanda]

Hi @dev3Masud,

Two things:

Please don't use public issues for security reports. Per our Security Policy, vulnerabilities should be reported privately so details aren't exposed before they're assessed. Could you re-send the full details through one of the private channels:

• Email: security@daytona.io
• GitHub private advisory: https://github.com/daytona/integrations/security/advisories/new

Please include full reproduction steps, the affected tier/plan, and the proof you captured.

On the behavior itself: unrestricted outbound internet access is the expected default on higher tiers, so on its own it isn't necessarily an isolation breach, it depends on the tier/configuration. Our security team will confirm once they have the full details via the private channel above.

To avoid keeping a potential security matter in a public thread, we'll close this issue in favor of the private channels.

Thanks for flagging it responsibly.