MaxKB, an open‑source enterprise AI assistant, allows an authenticated user to bypass the sandbox’s result validation. The attacker exploits Python frame introspection to read the wrapper’s UUID from bytecode constants and then writes a forged result directly to file descriptor 1, bypassing stdout redirection. By invoking sys.exit(0) the wrapper is terminated before producing legitimate output, and the service parses and trusts the spoofed response as a real tool result, effectively granting the user the ability to inject arbitrary output into the assistant’s responses.

This flaw affects the MaxKB application developed by 1Panel‑dev. Versions 2.7.1 and earlier are vulnerable; the issue was resolved in the 2.8.0 release.

The CVSS v3.1 score of 3.1 indicates a low severity vulnerability, and the EPSS score is not available. MaxKB is not listed in CISA’s KEV catalog, suggesting no known exploits in the wild. Exploitation requires authenticated access and knowledge of the internal Python wrapper, making the attack surface relatively narrow and likely limited to privileged users. Nevertheless, because forged results are treated as legitimate, an attacker can expose sensitive data or influence downstream processes.