Cloudflare's EmDash 1.0 blocks sandboxed plugins from site data until an admin approves
Cloudflare's EmDash 1.0 CMS starts each sandboxed plugin with only its own storage and blocks seven kinds of site resource until an admin approves. It answers the WordPress model, where every plugin shares the site's PHP process with direct access to its database, files and network.
The Watch · Security desk
What happened
- EmDash shows the access a plugin wants before it runs, and the runtime holds the plugin to that list, with each ability granted separately.
- In the published example, a search plugin can read published articles and reach its search service but cannot edit articles or contact other hosts.
- The plugin registry runs on AT Protocol, the network behind Bluesky, and publishers sign their releases and store them in their own Atmosphere accounts.
- EmDash checks each release against a signed commit, then confirms the checksum, package name, version, requested access and any required build provenance.
Why it matters
- What it limits constraint An attacker who takes over a sandboxed plugin through a bad update gets only the grants it already had, so a compromised plugin no longer hands over the whole site by default.
- Who's exposed exposure The administrator's approval is now the main control point, since a request approved without reading is enforced exactly like one that was reviewed.
- Who's exposed exposure Publisher Atmosphere accounts become the target for supply-chain attackers, because a takeover yields releases that pass EmDash's signature checks.
- What it limits constraint Responders facing a signed malicious release have no registry-wide recall to call on, so removal has to happen site by site.
Next story · Product · yesterday
Bluesky's Attie now turns a typed prompt into a small social app on the AT ProtocolConfirmed3 publishers
Cloudflare pitches EmDash as the "spiritual successor to WordPress" [2]. The plugin runtime is where the two part ways for anyone cleaning up after a compromise. Help Net Security's WordPress example is a contact form plugin that can technically read unpublished posts or send data anywhere, with the owner trusting it through every future update [3][4]. On EmDash the same form would start in an isolated runtime with its own private storage [9]. Content, media, users, secrets, environment, filesystem and network, seven classes in all, stay closed until it declares a need and an administrator approves [10][17]. An image optimizer gets the media library and no user content [16].
In Cloudflare's own comparison, installing a plugin is like installing a phone app [14]. Help Net Security names the weak spot that comes with that model: the runtime enforces whatever the administrator approved, including approvals granted without a glance [12]. A hostile plugin that asks for content and network access gets both with one careless approval. From then on the sandbox enforces the grant as written [10][12]. Help Net Security describes the model for sandboxed plugins and does not say whether EmDash lets any plugin run outside the sandbox [9].
Signing ties each release to the publisher account that committed it and to the access that release declares [5][6]. A release altered after signing, in its code or in its permission list, should fail the checksum and requested-access checks [6]. A signature proves who published a release. Help Net Security notes that a hijacked publisher account would produce valid signatures too [13].
Cloudflare built the registry with no central controller that can take over or remove plugins [7]. Moderation on EmDash's own catalog can hide a listing's name, description, links and images, and the release itself stays published [8].
What to watch
- Whether an EmDash plugin update that requests more access than its previous release forces a fresh administrator approval.
- The first reported takeover of an EmDash publisher's Atmosphere account, and how sites that approved the resulting release learn of it.
- Independent testing of EmDash's isolated plugin runtime for sandbox escapes.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption25
- Hype gap+25
- Incentives70
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Cloudflare released EmDash 1.0, a free, open source content management system.
- [2]
spiritual successor to WordPress
- [3]
In WordPress, plugins run inside the same PHP process as the rest of the application, with direct access to its database, filesystem, and network.
- [4]
A WordPress contact form plugin can technically read unpublished posts or send data anywhere, and the owner has to trust that it won't, through every future update.
- [5]
EmDash's plugin registry runs on AT Protocol, the decentralized network behind Bluesky; publishers sign their package and release records and store them in their own Atmosphere accounts.
- [6]
EmDash checks each release against a signed commit from the publisher's account, then confirms the checksum, package name, version, requested access, and any required build provenance.
- [7]
Cloudflare built the EmDash registry without a central controller that can take over or remove plugins.
- [8]
Moderation on EmDash's own catalog can hide a listing's name, description, links, and images, but the release itself stays published.
- [9]
EmDash 1.0 locks each sandboxed plugin in its own isolated runtime; a plugin starts with access to its own private storage.
- [10]
A sandboxed EmDash plugin cannot reach the site's content, media, users, secrets, environment, filesystem, or network until it declares what it needs and a site administrator approves the request.
- [11]
EmDash lists what a plugin wants before it runs, and the runtime holds it to that list; each ability stands alone.
- [12]
The EmDash runtime enforces whatever the administrator approved, including approvals granted without a glance.
- [13]
A signature proves who published a release; a hijacked publisher account would produce valid signatures too.
- [14]
Cloudflare compares installing a plugin to installing a phone app.
- [15]
A search plugin can read published articles and contact its search service, but it cannot edit articles or reach other hosts.
- [16]
An EmDash image optimizer plugin gets the media library and no user content.
- [17]
Seven classes of site resource are closed to a sandboxed EmDash plugin by default.
Sources
2 independent publishers whose own reporting we read for this story.
- blog.cloudflare.comEmDash 1.0: Cloudflare's WordPress 'Successor' is Now Stable
1 article · September 29, 2026
- helpnetsecurity.comCloudflare’s EmDash 1.0 makes sandboxed plugins ask for access first
1 article · September 29, 2026
Topics and entities
Topics
- Software Supply Chain Security
- CMS plugin security
- Content management systems