An attacker can leverage prompt injection - either through direct user interaction with the AI assistant or by poisoning ingested knowledge base (KB) documents - to trick the model into invoking the 'execute' shell tool. Because the 'execute' tool is not gated, the model performs this action without operator authorization. Furthermore, the application's sandbox implementation was previously susceptible to shell metacharacter escapes, allowing injected payloads to break out of the intended execution environment and run commands with root privileges. While version 2.10.5-lts provides hardening against the sandbox escape, the underlying lack of an authorization gate for the 'execute' tool remains, leaving systems vulnerable to unauthorized command execution if the assistant is prompted to use the tool.

Attack Chain

1. Attacker identifies a target instance of MaxKB running a version affected by CVE-2026-77521.
2. Attacker prepares a malicious document or direct chat prompt containing an adversarial prompt injection payload.
3. Target instance ingests the malicious document into its knowledge base or receives the chat message.
4. The AI assistant processes the input and triggers the internal 'execute' tool, which lacks a human-approval requirement.
5. The injected command, containing shell metacharacters (e.g., ';'), is passed to the application backend.
6. The SandboxShellBackend executes the command string, failing to neutralize the metacharacters.
7. The system executes the injected payload as root, granting the attacker control over the host environment.

Impact

The vulnerability is rated CVSS 10.0 and allows an unauthenticated attacker to achieve full root-level remote command execution. Successful exploitation results in complete compromise of the MaxKB application server, potentially leading to unauthorized data exfiltration, lateral movement within the network, and the disruption of AI services.

Recommendation

• Immediate priority: Manually gate the 'execute' tool within the MaxKB agency configuration to require human approval before any shell command is executed, as the current vendor patch does not address this logic flaw.
• Update all MaxKB deployments to at least version 2.10.5-lts to mitigate the documented sandbox escape path.
• Implement strict validation on all ingested documents and user-provided inputs to detect and block common prompt injection patterns before they reach the AI agent.
• Restrict the privileges of the system user running the MaxKB service to ensure it does not run as root, thereby limiting the potential damage of a successful command injection.