Description

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T16:17:46.667Z",
  "pubdate": "2026-08-28T16:17:46.667Z",
  "executiveSummary": "The 23blocks-OS ai-maestro framework, specifically version 0.24.17, contains a critical OS command injection vulnerability located within the killSessionSync function.\nThis vulnerability stems from improper neutralization of input data before it is passed to a system-level command execution primitive.\nAn attacker capable of providing crafted input to this function can achieve arbitrary command execution with the privileges of the underlying runtime process.\nThe impact includes full system compromise, unauthorized data access, and potential lateral movement within the host environment.\nThis flaw represents a significant security risk, as it allows unauthenticated or unauthorized parties to execute unintended instructions on the host OS.\nThe risk is exacerbated if the ai-maestro agent runs with elevated privileges, potentially leading to a complete host takeover.",
  "technicalDetails": "The vulnerability is situated in the lib/agent-runtime.ts file within the killSessionSync function.\nThe root cause is the usage of an insecure execution mechanism where user-controlled input is concatenated directly into a shell command string without adequate sanitization, escaping, or parameterization.\nWhen killSessionSync is invoked, the application fails to validate the structure of the input, allowing an attacker to inject shell metacharacters such as ';', '&&', or '|'.\nBy manipulating the session identifier or associated parameters, an attacker can break out of the intended command context and append arbitrary malicious commands.\nThe attack flow commences when an attacker delivers a specially crafted payload to an input vector that eventually reaches the vulnerable function.\nOnce the payload is received, the underlying runtime interpreter parses the injected command sequence, executing the attacker-supplied instructions in the shell environment context.\nBecause the function is designed to handle session termination, it may operate in an environment where the agent has sufficient permissions to modify files, trigger network connections, or exfiltrate sensitive configuration data.\nPost-exploitation impact is severe, as the attacker effectively operates with the permissions of the ai-maestro runtime; this could be used to install persistent backdoors, deploy ransomware, or exfiltrate data from the ai-maestro workspace.\nThe vulnerability is present in version 0.24.17 and persists until the input handling logic is refactored to use safe APIs that do not invoke a shell, such as execFile, which treats arguments as discrete entities rather than part of a single shell-parsed string."
}