{"record":{"id":"09bff3f725a7fb33","repo":"ruvnet/ruflo","slug":"security-plugin-loaded-without-sandboxing-pac","errorCode":null,"errorMessage":"[SECURITY] Plugin loaded without sandboxing: ${packageName}. Plugins run with full process access.","messagePattern":"\\[SECURITY\\] Plugin loaded without sandboxing: (.+?)\\. Plugins run with full process access\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/plugins/manager.ts","lineNumber":341,"sourceCode":"  // =========================================================================\n  // Enable/Disable\n  // =========================================================================\n\n  /**\n   * Enable a plugin\n   */\n  async enable(packageName: string): Promise<{ success: boolean; error?: string }> {\n    if (!this.manifest) {\n      await this.initialize();\n    }\n\n    const plugin = this.manifest!.plugins[packageName];\n    if (!plugin) {\n      return { success: false, error: `Plugin ${packageName} is not installed` };\n    }\n\n    // HIGH-04: Warn about unsandboxed plugin execution\n    console.warn(`[SECURITY] Plugin loaded without sandboxing: ${packageName}. Plugins run with full process access.`);\n\n    plugin.enabled = true;\n    await this.saveManifest();\n\n    return { success: true };\n  }\n\n  /**\n   * Disable a plugin\n   */\n  async disable(packageName: string): Promise<{ success: boolean; error?: string }> {\n    if (!this.manifest) {\n      await this.initialize();\n    }\n\n    const plugin = this.manifest!.plugins[packageName];\n    if (!plugin) {\n      return { success: false, error: `Plugin ${packageName} is not installed` };","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/cli/src/plugins/manager.ts#L323-L359","documentation":"Security warning (HIGH-04) in enable: the plugin about to be enabled was loaded without sandboxing, meaning it will run with full process access; enabling still proceeds but the risk is surfaced to the operator.","triggerScenarios":"Thrown at v3/@claude-flow/cli/src/plugins/manager.ts:341 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Only load trusted plugins, or run the process in a sandboxed environment; unsandboxed plugins have full process access."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}