CVE-2026-77521 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-77521

CVSS 10.0 · Critical EPSS 1,0%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Skor CVSS 3.1 10.0 (Critical) menurut github.com.

Deskripsi (NVD)

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.

Rincian

Terbit di NVD: 21 September 2026
Terakhir diubah: 22 September 2026
Status NVD: Deferred
CVSS 3.1: 10.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-250: Execution with Unnecessary Privileges
CWE-749: Exposed Dangerous Method or Function
EPSS (30 hari): 1,0% peluang dieksploitasi; lebih tinggi dari 63,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.