AIKIDO-2026-11070

TL;DR

The sandbox creation flow exposed a command injection flaw by embedding a JSON-serialized mcp config directly into a shell command enclosed in single quotes. Because standard JSON serialization does not escape single quotes, an attacker could supply a crafted config value containing ' to break out of the quoted context and append arbitrary shell commands. In practice, this could let a malicious user execute commands inside the sandbox during setup, potentially altering the environment, accessing sensitive data, or installing persistence. The issue is fixed by wrapping the JSON string with shlex.quote(), which safely escapes it for shell usage.