CVE-2026-97693

Received Received - Intake

Insufficient Sandbox Isolation in Yuxi Platform

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-97693

EUVD

EUVD-2026-117122

Affected Vendors & Products

Vendor	Product	Version / Range
xerrors	Yuxi	>= 0.6.0.beta1, < 0.7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Yuxi (versions 0.6.0.beta1 to 0.7.1) involves insufficient isolation between Docker sandboxes and trusted services. A low-privileged authenticated user can exploit this to access other tenants' sandboxes, files, secrets, and execute commands without needing admin or database credentials. Sandboxes can also interact with shared internal services, potentially leading to cross-tenant data exposure or modification.

Impact Analysis

If you use Yuxi in the affected versions, an attacker with low privileges could access your data, execute commands in your sandboxes, or disrupt other tenants' environments. This could lead to data breaches, unauthorized modifications, or service disruptions. Upgrading to version 0.7.1 or later is required to mitigate this risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using Yuxi must ensure proper isolation and access controls are in place to maintain compliance. Upgrading and rotating credentials is critical to address this risk.

Mitigation Strategies

Upgrade Yuxi to version 0.7.1 or later to address the insufficient isolation issue. Rotate persisted PostgreSQL, Neo4j, or MinIO credentials if they were set to default values. Ensure shared internal service credentials are changed from default settings.

Hi! I’m here to help you understand CVE-2026-97693. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...