{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/maxkb--2.10.5-lts/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["InertFluid"],"_cs_cpes":["cpe:2.3:a:1panel_dev:maxkb:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-77521"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MaxKB (\u003c= 2.10.5-lts)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["1Panel-dev"],"content_html":"\u003cp\u003eMaxKB, an open-source enterprise AI assistant and RAG platform, contains a critical vulnerability (CVE-2026-77521) that permits remote command execution (RCE). The vulnerability stems from two primary architectural flaws: a missing human-in-the-loop approval gate for the AI's internal 'execute' tool and a flawed sandbox mechanism that fails to sanitize shell metacharacters.\u003c/p\u003e\n\u003cp\u003eAn attacker can leverage prompt injection - either through direct user interaction with the AI assistant or by poisoning ingested knowledge base (KB) documents - to trick the model into invoking the 'execute' shell tool. Because the 'execute' tool is not gated, the model performs this action without operator authorization. Furthermore, the application's sandbox implementation was previously susceptible to shell metacharacter escapes, allowing injected payloads to break out of the intended execution environment and run commands with root privileges. While version 2.10.5-lts provides hardening against the sandbox escape, the underlying lack of an authorization gate for the 'execute' tool remains, leaving systems vulnerable to unauthorized command execution if the assistant is prompted to use the tool.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target instance of MaxKB running a version affected by CVE-2026-77521.\u003c/li\u003e\n\u003cli\u003eAttacker prepares a malicious document or direct chat prompt containing an adversarial prompt injection payload.\u003c/li\u003e\n\u003cli\u003eTarget instance ingests the malicious document into its knowledge base or receives the chat message.\u003c/li\u003e\n\u003cli\u003eThe AI assistant processes the input and triggers the internal 'execute' tool, which lacks a human-approval requirement.\u003c/li\u003e\n\u003cli\u003eThe injected command, containing shell metacharacters (e.g., ';'), is passed to the application backend.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eSandboxShellBackend\u003c/code\u003e executes the command string, failing to neutralize the metacharacters.\u003c/li\u003e\n\u003cli\u003eThe system executes the injected payload as root, granting the attacker control over the host environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability is rated CVSS 10.0 and allows an unauthenticated attacker to achieve full root-level remote command execution. Successful exploitation results in complete compromise of the MaxKB application server, potentially leading to unauthorized data exfiltration, lateral movement within the network, and the disruption of AI services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediate priority: Manually gate the 'execute' tool within the MaxKB agency configuration to require human approval before any shell command is executed, as the current vendor patch does not address this logic flaw.\u003c/li\u003e\n\u003cli\u003eUpdate all MaxKB deployments to at least version 2.10.5-lts to mitigate the documented sandbox escape path.\u003c/li\u003e\n\u003cli\u003eImplement strict validation on all ingested documents and user-provided inputs to detect and block common prompt injection patterns before they reach the AI agent.\u003c/li\u003e\n\u003cli\u003eRestrict the privileges of the system user running the MaxKB service to ensure it does not run as root, thereby limiting the potential damage of a successful command injection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T13:00:33Z","date_published":"2026-10-15T13:00:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-maxkb-rce/","summary":"MaxKB AI assistant platform is vulnerable to unauthenticated remote command execution due to prompt injection flaws in the 'execute' tool and insufficient sandbox escaping protections.","title":"Remote Command Execution in MaxKB via Prompt Injection","url":"https://feed.craftedsignal.io/briefs/2026-10-maxkb-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - MaxKB (\u003c= 2.10.5-Lts)","version":"https://jsonfeed.org/version/1.1"}