A small GitHub repo claims a draft FortiSandbox CVE and shows a Python test path aimed at an API endpoint named `/api/vnc/start`. The evidence is still thin because the retained material shows README text and usage examples, not independent validation or the Python implementation, so treat it as PoC triage material before treating it as a real finding.