EUVD-2026-67772
GHSA-gcxx-4qc7-cmmw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach agent-creation input
-
DeliverySubmit name with shell metacharacters
-
Exploittmux command built via execSync
-
ExecutionShell interprets injected payload
-
PersistArbitrary command execution on host
-
ImpactFull compromise of ai-maestro service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to control the agent or tmux session name that flows into killSessionSync/sessionExistsSync in lib/agent-runtime.ts, and the vulnerable path only exists in ai-maestro v0.24.17 and earlier (fixed in 0.24.18). The injected name must contain shell metacharacters and reach one of the execSync-based tmux operations (kill-session/rename-session), which occurs during session lifecycle handling. Limiting factors: the sink is tmux session management, so an attacker needs a route to inject a crafted name (agent creation/rename), and post-patch the createAgent allowlist plus execFileSync usage removes the shell entirely; deployments where agent names come only from trusted operators are far less exposed than those accepting names from untrusted API callers. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) rates this as critical, unauthenticated, network-exploitable RCE, but the underlying evidence is more nuanced: the injection sink is a local tmux session-management routine, and exploitation requires the attacker to control the agent/session name that reaches killSessionSync. Whether that input is reachable pre-authentication over the network depends on how ai-maestro exposes agent creation - the commit adds validation in createAgent, implying names originate from an agent-creation API, so real-world exploitation likely needs the ability to create/name an agent rather than a fully anonymous request. No EPSS score, SSVC decision, or KEV status was provided, and there is no CISA KEV listing, so there is no evidence of active or automatable mass exploitation. Net: a genuinely serious code-execution bug worth prompt patching, but the PR:N/AV:N framing may overstate reachability against a hardened or authenticated deployment - verify how agent names are accepted before treating it as anonymous internet-facing RCE. |
| Exploit ScenarioDerived | An attacker who can create or supply an agent/session name (for example via ai-maestro's agent-creation flow) sets the name to a value containing shell metacharacters such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
OS command injection in 23blocks-OS ai-maestro v0.24.17 lets an attacker who controls an agent or tmux session name run arbitrary shell commands on the host. The flawed killSessionSync path (lib/agent-runtime.ts) built tmux commands by interpolating the session name into a shell string passed to execSync, so metacharacters in the name break out into command context. The upstream commit 06d54f0 fixes it in v0.24.18 by switching to execFileSync with argument arrays and adding an agent-name allowlist; no public exploit or CISA KEV listing is confirmed, though a third-party research advisory exists.
RemediationAI
Upgrade to ai-maestro v0.24.18, which contains the fix commit 06d54f0687ad1fc5898a688a92f7e1f2df56c475 (Vendor-released patch: 0.24.18); this replaces shell-interpolating execSync calls with execFileSync argument arrays and enforces an agent-name allowlist. If you cannot upgrade immediately, restrict who can create or name agents/sessions and validate agent names against a strict character set (alphanumerics, hyphen, underscore, dot, forward slash) at your own ingress, mirroring the vendor's regex - trade-off: names using other characters will be rejected. Additionally, run the ai-maestro process as a low-privilege user and network-isolate the management interface so any residual injection cannot reach a privileged shell or be triggered by untrusted callers; note this limits exposure but is not a substitute for the patch. References: fix commit https://github.com/23blocks-OS/ai-maestro/commit/06d54f0687ad1fc5898a688a92f7e1f2df56c475 and advisory https://github.com/23blocks-OS/ai-maestro/security/advisories/GHSA-mf7j-vfrr-jmfh.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ai-maestro is a Node.js/TypeScript orchestration tool that manages AI agents inside tmux sessions, using Node's child_process to spawn and control those sessions. The root cause is CWE-78 (OS Command Injection): sessionExistsSync/killSessionSync and rename logic called nodeExecSync with template-literal strings such as tmux kill-session -t "${name}" and tmux rename-session -t "${oldName}" "${newName}", where the name value flows from the agent/session identifier. Because execSync spawns a shell, an unsanitized name containing shell metacharacters (backticks, $(), ;, |, &) is interpreted by the shell rather than treated as literal data. The patch removes execSync entirely, uses execFileSync('tmux', [...args]) so arguments bypass the shell, and adds a createAgent regex allowlist /^[a-zA-Z0-9\/_.-]+$/ to reject malicious names at ingestion (GHSA-mf7j-vfrr-jmfh). CPE data is uninformative here (cpe:2.3:a:n/a:n/a), so affected-product scoping relies on the GitHub repo and commit evidence.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Injection sink is reached via a supplied agent/session name, so an attacker likely needs the ability to create/name an agent (PR:L); successful injection yields full host code execution (C:H/I:H/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.
Executive ViewAI
23blocks-OS ai-maestro v0.24.17 contains a critical OS command injection vulnerability in the session management code that allows attackers who control agent or tmux session names to execute arbitrary shell commands, with no public exploit identified at time of analysis. This represents a severe risk to system integrity and confidentiality across any infrastructure running the affected version. Patch availability in v0.24.18 enables rapid remediation.
Apply vendor patch: upgrade to ai-maestro v0.24.18 immediately. If deployment is temporarily delayed, restrict network access to affected systems and tightly limit which users can modify session or agent name parameters.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB