CVE-2026-77521

LOWCVSS 10.0 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78CWE-250CWE-749

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Referenced assets1 URL

By indicator

http://vulntracker.io/cves/CVE-2026-77521

Full discourse2 posts

VulnTracker@vuln_tracker14h
One AI assistant, two separate paths to root (CVSS 10.0 and 9.1). CVE-2026-77521: MaxKB's tool and MCP agents expose a shell-execute function without human approval, so untrusted chat content alone can trigger command execution. CVE-2026-79916: A workspace member can inject control characters into AWS Bedrock credential fields, planting a malicious profile that runs an attacker's command as root. Both fixed in MaxKB 2.10.5-lts. Update now. Details: http://vulntracker.io/cves/CVE-2026-77521 #MaxKB #CVE #AI #PromptInjection #InfoSec #CyberSecurity
1000030
759 followersView on X
Welsh ICP Conviction 🏴󠁧󠁢󠁷󠁬󠁳󠁿🏉@ICPLEGEND196617h
🚨 internet-computer:native — AI AGENTS ARE GETTING POWERFUL ENOUGH TO TURN UNTRUSTED DATA INTO SYSTEM COMMANDS. 🤖🔐♾️ MaxKB has disclosed a CVSS 10.0 vulnerability, CVE-2026-77521. The reported chain is alarming: 📄 Untrusted content / chat → 🤖 AI agent interprets instructions → 🛠️ Tool access → 💻 Shell command execution → ⚠️ Missing human-approval boundary This is the fundamental AI security problem: CONTENT IS NO LONGER JUST DATA. With autonomous agents, content can become INSTRUCTIONS — and instructions can become ACTIONS. This is exactly why the architecture behind internet-computer:native and @dfinity is becoming increasingly relevant. ♾️ Tamper-resistant execution 🔐 Cryptographic authorization 🛡️ Protocol-level security & resilience ☁️ Sovereign Cloud Engines 🤖 AIware with enforceable guardrails ⚙️ Reduced dependence on conventional server stacks internet-computer:native cannot eliminate prompt injection or bad application logic. But the AI era needs infrastructure designed around the assumption that autonomous software WILL hold real authority. AI is accelerating. THE SECURITY ARCHITECTURE UNDERNEATH IT MUST ACCELERATE TOO. 🛡️♾️🔥 @dfinity @OccupyDemocrats #ICP #InternetComputer #AISecurity #CyberSecurity #AIware #CloudEngines ♾️ Support my internet-computer:native content: 1e672d038cebc619d93186418fa98f6499dbdb9cfdfac54f366c61a4a4ee4362
0001099
1.7K followersView on X

Explore more

Back to dashboard