Skip to content
OpenAdvisories
Critical · 10.0 Public exploit CVE-2026-77521 EUVD-2026-84161

MaxKB: Prompt-injectable agent can lead to command execution

Published Sep 21, 2026 · Updated Sep 22, 2026 · Assigned by GitHub_M

Vendor: 1Panel-dev Product: MaxKB

Description

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.

Affected products

VendorProductAffectedFixed
1Panel-dev MaxKB < 2.10.5-lts —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • InertFluid/cve-2026-77521-lab ★ 0 · Oct 15, 2026

    Benign, self-contained reproduction of CVE-2026-77521 (MaxKB prompt-injectable command execution)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References