CVE-2026-77521

Deferred Deferred - Pending Action

Command Execution in MaxKB AI Assistant

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-77521

Affected Vendors & Products

Vendor	Product	Version / Range
maxkb	maxkb	to 2.10.5-lts (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-250	The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
CWE-749	The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Attack-Flow Graph

Executive Summary

MaxKB before version 2.10.5-lts has a flaw in its SandboxShellBackend where shell command execution tools are not properly restricted. The execute tool lacks exclusion and interrupt_on settings, allowing untrusted chat or content to run arbitrary commands. This bypasses sandboxing, enabling command execution with the privileges of the application user.

Detection Guidance

To detect this vulnerability, check if your MaxKB instance is running a version prior to 2.10.5-lts. Verify if assistants use SandboxShellBackend and if shell execution tools are enabled without human approval requirements. Inspect logs for unexpected command execution attempts or unauthorized shell activity.

Impact Analysis

An attacker could exploit this to execute malicious commands on the system running MaxKB. This could lead to full system compromise, data theft, or unauthorized access. If MAXKB_SANDBOX is disabled, commands run directly as the application user. In the official root container, shell metacharacters could escape the sandbox entirely.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security, such as GDPR (Article 32) and HIPAA (Security Rule). It enables unauthorized command execution, risking data breaches, loss of integrity, and confidentiality. Organizations using affected versions may face regulatory penalties and reputational damage.

Mitigation Strategies

Immediately upgrade MaxKB to version 2.10.5-lts or later. Disable MAXKB_SANDBOX if enabled and ensure the sandbox is properly configured. Review and restrict permissions for shell execution tools in assistants. Monitor for unusual command execution patterns in logs.

Hi! I’m here to help you understand CVE-2026-77521. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70