{"metadata": {"vulnerability": "CVE-2026-97693", "count": 11, "kinds": {"milestone": 3, "sighting": 5, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-09-24T21:43:37.208Z", "date_only": false, "value": "2026-09-24T21:43:37.208Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-97693", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-04T21:14:50.408Z", "date_only": false, "value": "2026-11-04T21:14:50.408Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-97693", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-04T21:14:50.408Z", "date_only": false, "value": "2026-11-04T21:14:50.408Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-97693", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-04T21:14:50.408Z", "date_only": false, "value": "2026-11-04T21:14:50.408Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-97693", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T21:21:31.624Z", "date_only": false, "value": "2026-11-04T21:21:31.624038Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117560265340856541", "record": "CVE-2026-97693", "field": "creation_timestamp", "uuid": "690b28d3-e58c-4e38-9304-7623dfa26f5f", "content": "CVE-2026-97693 Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform.  From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them.\nhttps://www.cve.org/CVERecord?id=CVE-2026-97693https://github.com/xerrors/Yuxi/security/advisories/GHSA-qpm5-6332-9445https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663#xerrors #Yuxi#CVE_2026_97693#bot", "url": "https://infosec.exchange/users/cve/statuses/117560265340856541"}, {"timestamp": "2026-11-04T22:15:06.107Z", "date_only": false, "value": "2026-11-04T22:15:06.107917Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fc-vulns.bsky.social/post/3mzjev2vdyp2f", "record": "CVE-2026-97693", "field": "creation_timestamp", "uuid": "a4eab166-6515-4b8c-98e0-26ad4db6d293", "content": "Watch this new critical CVE. CVE-2026-97693 \u2014 CVSS 9.9.\n\nYuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform.\n\nhttps://www.fc-vulns.com/cve/CVE-2026-97693/\n\n#fcvulns #CWE77", "url": "https://bsky.app/profile/fc-vulns.bsky.social/post/3mzjev2vdyp2f"}, {"timestamp": "2026-11-04T22:18:07.687Z", "date_only": false, "value": "2026-11-04T22:18:07.687", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-97693", "record": "FKIE_CVE-2026-97693", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T22:18:07.687Z", "date_only": false, "value": "2026-11-04T22:18:07.687", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-97693", "record": "FKIE_CVE-2026-97693", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-04T22:20:02.773Z", "date_only": false, "value": "2026-11-04T22:20:02.773828Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzjf5vqqu62w", "record": "CVE-2026-97693", "field": "creation_timestamp", "uuid": "57fa0ea9-5d3b-41ec-9618-e637dccafbae", "content": "CVE-2026-97693 - yuxi\nVersions of Yuxi from 0.6.0.beta1 through 0.7.1 do not keep each user\u2019s sandbox separate from the others. A low\u2011privilege user who can run commands in their own sandbox could read files,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#yuxi #xerrors #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzjf5vqqu62w"}, {"timestamp": "2026-11-04T22:32:30.871Z", "date_only": false, "value": "2026-11-04T22:32:30.871015Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzjfu6vfiq23", "record": "CVE-2026-97693", "field": "creation_timestamp", "uuid": "c762f3ba-7b69-4d3e-922f-55b599d625d7", "content": "\ud83d\udd34 CVE-2026-97693 - Critical (9.9)\n\nYuxi is a large-model-based intelligent knowledge base and knowledge graph agent development plat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-97693/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzjfu6vfiq23"}, {"timestamp": "2026-11-05T00:08:15.327Z", "date_only": false, "value": "2026-11-05T00:08:15.327189Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzjl7fplcb2t", "record": "CVE-2026-97693", "field": "creation_timestamp", "uuid": "ce976eb8-b158-44e3-a8b3-c0635377805f", "content": "\ud83d\udea8 CVE-2026-97693 \u2014 CVSS 9.9 CRITICAL\n\nYuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-97693\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzjl7fplcb2t"}], "metrics": {"as_of": "2026-11-05T12:05:55.515Z", "anchors": {"origin": {"timestamp": "2026-11-04T21:14:50.408Z", "date_only": false, "value": "2026-11-04T21:14:50.408Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-97693", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-04T21:14:50.408Z", "date_only": false, "value": "2026-11-04T21:14:50.408Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-97693", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 53465.107013, "hours": 14.851418614722222, "days": 0.6188091089467592, "min_seconds": 53465.107013, "max_seconds": 53465.107013, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-04T21:14:50.408Z", "date_only": false, "value": "2026-11-04T21:14:50.408Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-97693", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T12:05:55.515Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}