Vercel has published the findings from its $1M Sandbox Challenge, paying out $242,000 in bug bounties across 1,285 reports received over two weeks. The most critical discovery was a zero-day vulnerability in the Linux kernel networking stack, enabling attackers to escape microVM isolation, execute code, and take control of the host machine.
The zero-day defect was submitted on day three of the challenge by security researcher Paulos Yibelo (pwn.ai) via HackerOne. By sending specially crafted network packets from within a standard sandbox, Yibelo demonstrated three attacks: leaking host memory over the network, crashing the physical host machine with just two packets, and running commands with full administrative privileges on the host. Vercel stated that because major cloud providers rely on this same Linux kernel isolation layer, it collaborated immediately with AWS and upstream Linux maintainers on private patches, with official CVE identifiers currently pending.
Out of 1,285 total submissions, Vercel validated 57 reports, consisting of 1 Critical, 5 High, 9 Medium, and 42 Low findings. Another notable issue involved cross-tenant disk snapshot restoration: the control plane trusted snapshot location data returned directly by software running inside the guest microVM. This trust boundary violation allowed swapping snapshot storage objects between two accounts controlled by the researcher. Vercel resolved the issue within a week by moving snapshot creation to a host-side service and scoping storage paths strictly to project URLs.
Alongside the public bounty, cybersecurity firm Trail of Bits spent four engineer-weeks reviewing Vercel Sandbox's source code and architecture. They verified that the Firecracker microVM boundary is structurally sound and delivered 20 findings to eliminate guest trust and enforce strict process isolation using Firecracker's jailer. Additionally, Marcos Hernanez, a Vercel intern, identified a cross-tenant data leak within the Linux device-mapper storage layer. Vercel confirmed that no reports demonstrated unauthorized access to customer files, secrets, or application data.