The vulnerability exists because MaxKB’s ToolExecutor uses LD_PRELOAD to intercept standard execve system calls, but no interception is applied to fexecve. An attacker who is authenticated and able to run tool code can invoke fexecve to launch a process outside the sandbox, thereby bypassing the intended subprocess restrictions. This can allow the attacker to run arbitrary commands with the privileges of the authenticated user. The weakness is a form of improper restriction of operations within task bounds, identified as CWE‑693.

Affected systems are instances of MaxKB provided by 1Panel‑dev, specifically any release earlier than version 2.10.6‑lts. Version 2.10.6‑lts and later include the necessary hook for fexecve and are not vulnerable. The product is an open‑source AI assistant used in enterprise environments.

The CVSS score of 6.3 classifies the issue as moderate, and the EPSS score is not available, suggesting no publicly known exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers require authentication to execute tool code, so the most realistic attack vector is an authenticated local user. The impact allows bypass of sandbox restrictions, raising the risk of accidental or malicious process creation with elevated privileges.