diff --git a/containers/Dockerfile b/containers/Dockerfile
index 575855a376..7d125ca834 100644
--- a/containers/Dockerfile
+++ b/containers/Dockerfile
@@ -196,6 +196,22 @@ RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/
 
 RUN apt-get install -y wapiti
 
+# CVE-2026-111497: out-of-bounds write in the brotli decoder, fixed in brotli
+# 1.2.1 / Debian 1.2.0-4.1. kali-rolling still ships 1.2.0-4, and node, curl and
+# python3 in this image all load the shared libbrotlidec, so every HTTP client here
+# would decode a malicious `Content-Encoding: br` response with the vulnerable
+# code. Install the fixed Debian packages until Kali picks them up.
+ARG BROTLI_DEB_VERSION=1.2.0-4.1
+RUN set -eux; \
+    ARCH="$(dpkg --print-architecture)"; \
+    for pkg in libbrotli1 python3-brotli; do \
+        curl -fsSL "https://deb.debian.org/debian/pool/main/b/brotli/${pkg}_${BROTLI_DEB_VERSION}_${ARCH}.deb" -o "/tmp/${pkg}.deb"; \
+    done; \
+    dpkg -i /tmp/libbrotli1.deb /tmp/python3-brotli.deb; \
+    rm -f /tmp/libbrotli1.deb /tmp/python3-brotli.deb; \
+    test "$(dpkg-query -W -f='${Version}' libbrotli1)" = "${BROTLI_DEB_VERSION}"; \
+    node -e 'const z=require("zlib");z.brotliDecompressSync(z.brotliCompressSync(Buffer.from("ok")))'
+
 USER pentester
 
 RUN pipx install semgrep && \
diff --git a/docs/advanced/configuration.mdx b/docs/advanced/configuration.mdx
index 2048eefe65..dfd28d23fe 100644
--- a/docs/advanced/configuration.mdx
+++ b/docs/advanced/configuration.mdx
@@ -170,7 +170,7 @@ When remote vars are set, Strix dual-writes telemetry to both local JSONL and th
 
 ## Docker Configuration
 
-<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.3.0" type="string">
+<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.3.1" type="string">
   Docker image to use for the sandbox container.
 </ParamField>
 
diff --git a/scripts/install.sh b/scripts/install.sh
index e179b558e4..876f11db28 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 APP=strix
 REPO="usestrix/strix"
-STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.3.0"
+STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.3.1"
 
 MUTED='\033[0;2m'
 RED='\033[0;31m'
diff --git a/strix/config/settings.py b/strix/config/settings.py
index eb61a793d4..b1a9be4a84 100644
--- a/strix/config/settings.py
+++ b/strix/config/settings.py
@@ -155,7 +155,7 @@ class RuntimeSettings(BaseSettings):
     model_config = _BASE_CONFIG
 
     image: str = Field(
-        default="ghcr.io/usestrix/strix-sandbox:1.3.0",
+        default="ghcr.io/usestrix/strix-sandbox:1.3.1",
         alias="STRIX_IMAGE",
     )
     backend: str = Field(default="docker", alias="STRIX_RUNTIME_BACKEND")