Database/AI/ML frameworks & serving
NVIDIA OpenShell: incomplete input denylist in the sandbox provisioning API allows code execution
Impact
The sandbox provisioning API enforces its restrictions with a list of disallowed inputs that NVIDIA describes as incomplete, so a caller can supply values the check was meant to block. NVIDIA rates the result as code execution, privilege escalation, information disclosure, data tampering and denial of service, scored with a scope change (CVSS:3.1 S:C), meaning the effect reaches beyond the sandbox that was provisioned. OpenShell sandboxes are where agent-generated and otherwise untrusted code is meant to be confined on a fleet node, so a caller who can shape provisioning gets whatever the sandbox host process holds - including its GPU access and any credentials the serving stack passes in. On a shared node this is the boundary that separates one tenant's agent session from the rest of the box.
Who can reach it
Network reachable, low-privilege authentication required (CVSS AV:N/PR:L): anyone permitted to call the OpenShell sandbox provisioning API, such as a tenant or agent session allowed to create sandboxes.
What to do
Update OpenShell to v0.0.34, which NVIDIA's bulletin 5872 states fixes all OpenShell issues in this batch; the advisory's instruction is to clone or update from the NVIDIA/OpenShell GitHub repository. Versions 0 through 0.0.33 are affected on all platforms. Rollout is a userspace service update - redeploy the OpenShell components and restart them; the advisory names no firmware, driver or kernel change, so no node drain or reboot is called for.
References
Related entries
- NVIDIA OpenShell: sandbox escape lets confined code run outside the sandboxCVE-2026-65093 · NVIDIA OpenShell (agent sandbox confinement)Critical
- scikit-learn / joblib: `joblib.load()` executes commands from an untrusted file via `__reduce__`CVE-2020-13092 · scikit-learn / joblibCritical
- PyTorch (`torch.jit.annotations.parse_type_line`): Arbitrary code execution via unsafe `eval` in TorchScript typeCVE-2022-45907 · PyTorch (`torch.jit.annotations.parse_type_line`)Critical
- MLflow: Path traversal prior to 2.3.1CVE-2023-2780 · MLflowCritical
- LangChain (`LLMMathChain`): Prompt injectionCVE-2023-29374 · LangChain (`LLMMathChain`)Critical
- LangChain (PALChain): Arbitrary code execution via `os.system`/`exec` in generated codeCVE-2023-36258 · LangChain (PALChain)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.