LXD Shell-Parsed compression_algorithm Reached Host Command Execution

Root Cause

The vulnerable endpoints accepted compression_algorithm as a plain string and later flowed it into command execution without restricting the value to a safe allowlist. LXD therefore treated a shell-sensitive parameter as though it were a benign enum.

Because the resulting commands ran on the host rather than inside an isolated container context, successful injection crossed directly into host compromise. The permissions needed were not admin-only, which made the reachable blast radius much larger in shared deployments.

Weaknesses