Yuxi: sandbox tenants reach other tenants' sandboxes, shared services and the unauthenticated provisioner

Impact

Yuxi runs per-user execution sandboxes as Docker containers alongside the trusted application services, with no network or authentication boundary between them. Any low-privileged authenticated user who can run commands in their own sandbox can call other tenants' sandbox APIs, read their files and secrets, execute commands inside their live sandboxes, and enumerate, create or delete sandboxes through a provisioner that requires no authentication at all. Sandboxes can also reach the shared PostgreSQL, Neo4j and MinIO services; where the shipped default credentials are still in place an attacker can authenticate to them, and a superuser PostgreSQL account yields command execution in the database container. None of this needs a container escape or a kernel bug, so a hardened host does not help: on a shared inference or agent node this is straightforward cross-tenant data disclosure, tampering and denial of service by deleting other tenants' sandboxes.

Who can reach it

Any authenticated low-privilege user of the deployment who can execute commands in their own sandbox. The sandbox provisioner path needs no credentials beyond reachability from a sandbox or the deployment network.

What to do

Upgrade to 0.7.1 and restart the Compose stack. Upgrading the Compose files does not rotate credentials, so separately rotate any PostgreSQL, Neo4j and MinIO passwords that were left at the documented or shipped defaults, and demote the PostgreSQL account from superuser if it is one. Treat every sandbox that existed before the upgrade as having had its files and secrets exposed. No node reboot is needed - this is a service restart plus credential rotation.

References

Related entries

• scikit-learn / joblib: `joblib.load()` executes commands from an untrusted file via `__reduce__`CVE-2020-13092 · scikit-learn / joblibCritical
• PyTorch (`torch.jit.annotations.parse_type_line`): Arbitrary code execution via unsafe `eval` in TorchScript typeCVE-2022-45907 · PyTorch (`torch.jit.annotations.parse_type_line`)Critical
• MLflow: Path traversal prior to 2.3.1CVE-2023-2780 · MLflowCritical
• LangChain (`LLMMathChain`): Prompt injectionCVE-2023-29374 · LangChain (`LLMMathChain`)Critical
• LangChain (PALChain): Arbitrary code execution via `os.system`/`exec` in generated codeCVE-2023-36258 · LangChain (PALChain)Critical
• LangChain (`load_prompt`): Arbitrary code execution from a JSON prompt fileCVE-2023-36281 · LangChain (`load_prompt`)Critical