Description

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-21T21:17:10.943Z",
  "pubdate": "2026-09-21T21:17:10.943Z",
  "executiveSummary": "MaxKB versions prior to 2.10.5-lts are vulnerable to critical remote code execution (RCE) flaws originating from the insecure implementation of the SandboxShellBackend component.\nThe vulnerability arises from improper validation and lack of human-in-the-loop authorization for shell-executing tools utilized by AI assistants.\nAttackers can leverage untrusted chat inputs or malicious ingested content to trigger unauthorized command execution within the application environment.\nThe risk is exacerbated in deployments where the MAXKB_SANDBOX feature is disabled, causing commands to run directly under the application user's privileges.\nFurthermore, in official containerized environments, the use of a string-based gosu wrapper allows for shell metacharacter injection, effectively bypassing intended sandbox isolation mechanisms.\nThis vulnerability poses a severe threat to enterprise confidentiality, integrity, and availability, as it grants attackers the ability to execute arbitrary commands on the underlying host system.",
  "technicalDetails": "The vulnerability resides within the SandboxShellBackend module, which serves as the execution engine for AI assistant tools, including MCP tools, skills, and sub-applications.\nIn affected versions of MaxKB (prior to 2.10.5-lts), the system fails to apply necessary exclusions for the shell execution tool, and crucially, it omits the 'execute' action from the 'interrupt_on' configuration. This omission bypasses mandatory human-approval workflows, allowing automated execution of potentially malicious commands.\nThe attack vector involves injecting malicious payloads through chat interfaces or ingestion pipelines. When the MaxKB AI assistant processes this untrusted input, it may invoke the SandboxShellBackend to perform a task. Because the execution is not restricted or sandboxed correctly, the payload is passed directly to the system shell.\nFor deployments where the 'MAXKB_SANDBOX' environment variable is disabled, commands are executed with the full privilege set of the application user. This leads to immediate system compromise if the application runs with elevated privileges or has access to sensitive files.\nIn the context of the official containerized distribution, the vulnerability is further aggravated by a flawed gosu implementation. The application utilizes a string-based wrapper that does not properly sanitize input, permitting shell metacharacters (e.g., ';', '&', '|', '`') to break out of the intended command structure. This allows an attacker to terminate the intended command and append arbitrary malicious commands that execute outside of the intended container sandbox constraints.\nPost-exploitation, an attacker can move laterally, exfiltrate environment variables containing API keys or database credentials, or deploy persistent backdoors within the infrastructure hosting the MaxKB instance. The lack of authentication requirements for the initial chat interface means that unauthenticated users may, depending on the implementation configuration, trigger these code execution sequences."
}