EUVD-2026-22178Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
6DescriptionGitHub Advisory
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mechanism allows an authenticated user with tool execution privileges to escape the LD_PRELOAD-based sandbox. By env command the attacker can clear the environment variables and drop the sandbox.so hook, leading to unrestricted Remote Code Execution (RCE) and network access. MaxKB restricts untrusted Python code execution via the Tool Debug API by injecting sandbox.so through the LD_PRELOAD environment variable. This intercepts sensitive C library functions (like execve, socket, open) to restrict network and file access. However, a patch allowed the /usr/bin/env utility to be executed by the sandboxed user. When an attacker is permitted to create subprocesses, they can execute the env -i python command. The -i flag instructs env to completely clear all environment variables before running the target program. This effectively drops the LD_PRELOAD environment variable. The newly spawned Python process will therefore execute natively without any sandbox hooks, bypassing all network and file system restrictions. This issue has been fixed in version 2.8.0.
AnalysisAI
MaxKB versions 2.7.1 and below allow authenticated users with tool execution privileges to bypass the LD_PRELOAD-based sandbox via the env command, enabling unrestricted remote code execution and network access. The vulnerability stems from a patch that permitted execution of /usr/bin/env, which attackers can exploit using env -i to clear environment variables and drop the sandbox.so hook before spawning a native Python subprocess. Vendor-released patch: version 2.8.0.
Technical ContextAI
MaxKB implements sandbox protection for the Tool Debug API by injecting sandbox.so through the LD_PRELOAD environment variable, a Unix/Linux mechanism that forces dynamic linking of a shared object before other libraries. The sandbox.so library intercepts sensitive C library functions (execve, socket, open) to restrict network and file system access in untrusted Python code execution contexts. The vulnerability exploits a logic flaw in sandbox enforcement: while the LD_PRELOAD mechanism itself is sound, the implementation failed to restrict execution of /usr/bin/env, a utility designed to run commands in a modified environment. The env -i flag completely clears all environment variables before executing a target program, which directly removes the LD_PRELOAD variable that enforces the sandbox hook. This falls under CWE-693 (Protection Mechanism Failure), where a security control is nominally in place but incomplete restrictions allow bypass. The affected product is MaxKB (1Panel-dev/MaxKB per CPE cpe:2.3:a:1panel-dev:maxkb), which is an open-source enterprise AI assistant framework.
RemediationAI
Upgrade MaxKB immediately to version 2.8.0 or later, which includes a patch that restricts execution of /usr/bin/env and other bypass vectors. No workaround is available for versions below 2.8.0 other than removing tool execution privileges from untrusted users. Detailed patch information is available at the GitHub security advisory (https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-7wgv-v2r3-7f7w) and the specific fix commit (https://github.com/1Panel-dev/MaxKB/commit/2d17b08e6b060329803754a05e806d0ddecf3fa8). Release notes for v2.8.0 are at https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-693 – Protection Mechanism Failure
View allShare
External POC / Exploit Code
Leaving vuln.today