MaxKB, an open‑source AI assistant, had a flaw that allowed an attacker to inject prompts into the agent’s tool backend, causing the application to execute arbitrary shell commands. The missing human approval step and the omission of execute from interrupt_on let untrusted chat or ingested content be run as the MaxKB application user. Because the container’s string‑based gosu wrapper permits shell metacharacters to escape the intended sandbox, an attacker could run commands with the privileges of the running application, potentially compromising confidentiality, integrity, and availability of the host.

The affected product is 1Panel‑dev’s MaxKB. All versions prior to 2.10.5‑lts are vulnerable. The issue remains present in deployments that run without the MAXKB_SANDBOX setting enabled or that rely on the vulnerable version of the code.

The flaw is scored at CVSS 10 and is not listed in the CISA KEV catalog. The EPSS score of 1% indicates a low but non-zero exploitation probability. The described attack path—injecting malicious content into the agent’s prompt—does not require elevated privileges and can be triggered by any user interacting with the AI assistant. Consequently, exploitation is possible for any environment that accepts untrusted input, making it a severe remote code execution vulnerability.