Database/AI/ML frameworks & serving
NVIDIA OpenShell: sandbox exec handler is vulnerable to OS command injection, breaking the sandbox boundary
Impact
NVIDIA reports an OS command injection in the sandbox exec handler of OpenShell for Linux, leading to code execution, information disclosure and data tampering. The whole point of a sandbox exec handler is to bound what submitted commands may do, so an injection there means the boundary an operator was relying on does not hold and the attacker runs with whatever privileges the handler process carries. Where this tooling is deployed on GPU nodes to run untrusted or model-generated commands, that is a path from a constrained execution context to the node's own userspace. NVIDIA scores it network-reachable with low privileges required, but with high attack complexity, and rates confidentiality and integrity impact high with no availability impact. The advisory record given here does not describe the affected versions or the injection mechanism further.
Who can reach it
Network-reachable per NVIDIA's vector (AV:N), with low privileges required - an account that can submit work to the sandbox exec handler. Attack complexity is rated high, so exploitation is not expected to be trivial.
What to do
Update NVIDIA OpenShell to the fixed release identified in NVIDIA's advisory (product-security bulletin 5872, which also covers CVE-2026-65082); the record here does not state a fixed version, so read the bulletin before planning. Until then, treat the sandbox as a soft boundary rather than a security control and restrict who can submit commands to it.
References
Related entries
- Hugging Face Transformers: checkpoint index shard names traverse out of the model directoryCVE-2026-75104 · Hugging Face Transformers (checkpoint shard index filename handling)Medium
- Ollama: DNS rebinding grants a remote page full API accessCVE-2024-28224 · OllamaMedium
- Dagster (gRPC `get_notebook_data`): Local file inclusion — read arbitrary filesCVE-2025-51481 · Dagster (gRPC `get_notebook_data`)Medium
- llama.cpp (GGUF vocabulary parsing, llama_vocab::impl::print_info): MALICIOUS MODEL FILE CRASHES THE SERVER: the GGUFNCVD-2025-020-llama-cpp-gguf-vocabulary-parsin · llama.cpp (GGUF vocabulary parsing, llama_vocab::impl::print_info)Medium
- Kubeflow: SSRFCVE-2023-6570 · KubeflowMedium
- Gradio: SSRF in the `/proxy` routeCVE-2024-2206 · GradioMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.