Executive brief
MaxKB is an open-source AI assistant platform that allows organizations to build intelligent chatbots. Prior to version 2.10.5-lts, the system failed to properly restrict shell command execution in assistant tools, allowing untrusted chat messages or uploaded content to trigger arbitrary commands. In deployments with sandboxing disabled, commands run with application user privileges; in containerized setups, shell metacharacters could escape the sandbox entirely, enabling complete system compromise.
Technical details
The SandboxShellBackend did not exclude the execute shell tool from the assistant's available actions and failed to add it to an interrupt list requiring human approval, allowing LLM-controlled command execution. The vulnerability affects tools, MCP tools, skills, and sub-applications that use this backend. Root-cause fixes involved implementing command splitting (via shlex) and proper sandbox command construction to prevent shell metacharacter injection.
Affected products
- 1Panel-dev MaxKB prior to 2.10.5-lts
Timeline
- 2026-09-21: disclosed
- 2026-08-06: patched: v2.10.5-lts release with sandbox command building and command splitting fixes