MaxKB - Prompt Injection & OS Command Injection & Execution with Unnecessary Privileges
MaxKB is an open-source platform for building knowledge-base question-answering and AI agent applications. Its assistants can use tools, MCP tools, skills and sub-applications. CVE-2026-77521 Before version 2.10.5-lts, MaxKB assistants that use a tool, MCP tool, skill or sub-application rely on SandboxShellBackend. This exposes a shell execute tool that is not excluded and is left out of interrupt_on, so no human approval is required. Untrusted chat or ingested content can therefore make the agent run commands (prompt injection leading to command execution). Source deployments with MAXKB_SANDBOX disabled run the commands directly as the application user. In the official root container, a string-based gosu wrapper let shell metacharacters run outside the intended sandbox. The weaknesses are CWE-78, CWE-250 and CWE-749. CISA ADP SSVC rates exploitation as "poc", automatable as "yes" and technical impact as "total". Versions before 2.10.5-lts are affected, and 2.10.5-lts fixes the issue.
