Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

MaxKB before 2.10.5-lts can run commands from chat input

CVE-2026-77521 · published 28 days ago
Summary

The MaxKB AI assistant lets users send prompts that can trigger the system to execute operating‑system commands without needing approval. This could allow an attacker to run unwanted code on the server hosting MaxKB. Upgrade to version 2.10.5-lts or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
1panel-dev maxkb < 2.10.5-lts
Original advisory text
MaxKB: Prompt-injectable agent can lead to command execution
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-78OS Command Injection
CWE-250Execution with Unnecessary Privileges
CWE-749Exposed Dangerous Method or Function
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Sources
CVE-2026-77521 · NVD
CVE-2026-77521 · MITRE
CVE-2026-77521 · OSV
GHSA-f36j-f34j-h3rx · GHSA
Track software like this
Free during beta