EUVD-2026-22180Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
6DescriptionGitHub Advisory
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnerability in the ToolExecutor component. By leveraging Python's ctypes library to execute raw system calls, an authenticated attacker with workspace privileges can bypass the LD_PRELOAD-based sandbox.so module to achieve arbitrary code execution via direct kernel system calls, enabling full network exfiltration and container compromise. The library intercepts critical standard system functions such as execve, system, connect, and open. It also intercepts mprotect to prevent PROT_EXEC (executable memory) allocations within the sandboxed Python processes, but pkey_mprotect is not blocked. This issue has been fixed in version 2.8.0.
AnalysisAI
MaxKB versions 2.7.1 and below allow authenticated attackers with workspace privileges to execute arbitrary code by exploiting a sandbox escape vulnerability in the ToolExecutor component. By leveraging Python's ctypes library to invoke raw system calls and bypassing the LD_PRELOAD-based sandbox.so module through the unblocked pkey_mprotect syscall, attackers can achieve remote code execution, enabling network exfiltration and container compromise. This vulnerability is confirmed fixed in version 2.8.0, and no public exploit code has been identified at time of analysis.
Technical ContextAI
MaxKB implements a sandbox for the ToolExecutor component using LD_PRELOAD to intercept critical system functions (execve, system, connect, open, and mprotect) within Python processes. The sandbox uses mprotect interception to prevent PROT_EXEC memory allocations, restricting code execution capabilities. However, the sandbox fails to intercept the pkey_mprotect syscall, a newer memory protection mechanism introduced in Linux kernel 4.6 that provides fine-grained memory access control via memory protection keys. By calling ctypes to directly invoke pkey_mprotect, attackers bypass the sandbox's mprotect restrictions and restore executable memory permissions. This occurs within the context of Python's ctypes library, which allows low-level foreign function interface calls to kernel syscalls without higher-level abstraction. The vulnerability is classified as CWE-693 (Protection Mechanism Failure), indicating the root cause is an incomplete or improperly configured security control that fails to comprehensively block all execution pathways.
RemediationAI
Vendor-released patch: MaxKB version 2.8.0 or later. Upgrade to version 2.8.0 or any newer version immediately by pulling the latest release from https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0. The fix is also available in the upstream repository via commit 479701a4d2e6059506bad0057a66bed91abb5aef (https://github.com/1Panel-dev/MaxKB/commit/479701a4d2e6059506bad0057a66bed91abb5aef), which comprehensively addresses the pkey_mprotect bypass. No workarounds are available prior to patching; the only effective mitigation is to restrict workspace access to highly trusted users and isolate MaxKB containers from sensitive network segments until patching is completed.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-693 – Protection Mechanism Failure
View allShare
External POC / Exploit Code
Leaving vuln.today