CVE-2026-77521 Details
Description
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.
A remote code execution vulnerability exists in MaxKB versions prior to 2.10.5-lts. The issue arises when assistants use the SandboxShellBackend, which unintentionally exposes an execute shell tool without proper restrictions. This allows untrusted chat or ingested content to trigger command execution. In source deployments with MAXKB_SANDBOX disabled, commands are executed as the application user. The official root container's gosu wrapper mismanaged shell metacharacters, executing commands outside the intended sandbox.
Users should update to MaxKB version 2.10.5-lts or later. After updating, ensure that the MAXKB_SANDBOX environment variable is set to enable the sandbox feature. For deployments that do not use the official container, be aware that the sandbox is disabled by default and must be manually enabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f36j-f34j-h3rx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/1Panel-dev/MaxKB/commit/594f50f2ea80a502d1c955371ba0438b277c30ea | [email protected] | Source CodeVendor |
| https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.5-lts | [email protected] | Release NotesVendor |
| https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f36j-f34j-h3rx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-250 | Execution with Unnecessary Privileges | [email protected] |
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 1Panel-dev MaxKB | <= 2.10.3-lts (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |