Yuxi, a large‑model‑based knowledge base platform, suffered from insufficient isolation between execution‑capable Docker sandboxes and trusted application services. A low‑privileged authenticated user can reach other tenants’ sandbox APIs, access files and secrets, execute commands within active sandboxes, and enumerate, create, or delete sandboxes through an unauthenticated provisioner. This allows the attacker to compromise internal shared services, such as PostgreSQL and MinIO, if default credentials are unchanged, potentially achieving full command execution on the database container. The flaw is rooted in improper authorization (CWE‑284), insecure handling of stored credentials (CWE‑522), and command injection via sandbox commands (CWE‑77). The impact includes disclosure or modification of cross‑tenant data, state corruption of isolated sandboxes, and denial‑of‑service through sandbox termination.

The affected product is Yuxi by xerrors, covering releases from version 0.6.0.beta1 up to and including 0.7.1. Upgrading to 0.7.1 removes the sandbox isolation failure, but deployments that relied on previously set default credentials for PostgreSQL, Neo4j, or MinIO require those stored passwords to be rotated manually, as the Composer file upgrade does not perform this automatically.

The CVSS score of 9.9 indicates critical severity, yet the EPSS score is not available, so the likelihood of exploitation at present is not quantifiable from the available data. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be authenticated access to the Yuxi service on the same host or network, with the attacker leveraging sandbox execution capabilities to reach other tenants’ APIs and internal services. Even without container escape or kernel exploitation, the flaw permits data leakage, state corruption, and denial of service.