ServiceNow AI Platform: Sandbox escape in Rhino sandbox
ServiceNow AI Platform contains a sandbox escape in the Rhino sandbox. An authenticated user with the admin role can bypass the sandbox restrictions and execute arbitrary code on the underlying host operating system, which may enable further unintended access. Exploitation requires a valid admin session, not anonymous internet access. ServiceNow has deployed the fix to hosted instances and provided it to partners and self-hosted customers.
ServiceNow · AI Platform
