---
id: CVE-2026-97693
title: >-
  Yuxi sandbox isolation failure allows cross-tenant access and internal service
  compromise
summary: >-
  Yuxi is a large-model-based intelligent knowledge base and knowledge graph
  agent development platform.  From 0.6.0.beta1 until 0.7.1, there is
  insufficient isolation between execution-capable Docker sandboxes and trusted
  application serv…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-77
  - CWE-284
  - CWE-522
vendor: xerrors
product: Yuxi
affected:
  - 'Yuxi >= 0.6.0.beta1, < 0.7.1'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:14:50.408Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-97693'
references:
  - url: 'https://github.com/xerrors/Yuxi/security/advisories/GHSA-qpm5-6332-9445'
    label: 'https://github.com/xerrors/Yuxi/security/advisories/GHSA-qpm5-6332-9445'
  - url: >-
      https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663
    label: >-
      https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.608Z'
epss: 0.00804
epssPercentile: 0.56971
---

## Overview

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform.  From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them.

## Affected

- `Yuxi >= 0.6.0.beta1, < 0.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.