Aix-DB CVE-2026-77926

Exploitation requires a valid authenticated but non-admin Aix-DB account (CVSS PR:L); it does not require admin rights or any user interaction. The core prerequisite is the ChatBI 'common agent' exposing the deepagents execute tool in an ungated manner, which lets authenticated users reach OS command execution via either crafted chat input to the POST /dify/get_answer endpoint or an uploaded document containing malicious text. The practical limiting factors for defenders are the authentication requirement and the narrow, specific deployment of Aix-DB 1.2.4 with the ChatBI common agent enabled; environments that restrict account registration or do not expose this agent face materially lower exposure.

This is a credible high-priority issue for anyone actually running Aix-DB 1.2.4. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account and no user interaction, with full High impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) - consistent with CWE-749 (exposure of a dangerous execute function) and the described host OS command execution. Publicly available exploit code (VulnCheck advisory plus a lasso.security writeup and a direct link to the vulnerable source line) sharply raises practical risk, as the attack is well-documented and reproducible. There is no CISA KEV listing and no EPSS score provided, so there is no evidence of active, widespread exploitation yet - the elevated risk here comes from POC availability and ease of exploitation rather than confirmed in-the-wild use. The main mitigating factor against mass exploitation is the PR:L requirement (an attacker needs valid non-admin credentials) and the product's apparently narrow deployment footprint, which together argue for prompt patching where deployed but not for emergency internet-wide panic. No signals are internally conflicting: CVSS network vector aligns with the HTTP endpoint (POST /dify/get_answer) and document-upload vectors in the description.

An attacker with an ordinary (non-admin) Aix-DB account sends crafted chat input to POST /dify/get_answer, or uploads a document containing malicious text, causing the ChatBI common agent's ungated deepagents execute tool to run attacker-supplied operating system commands on the host. Public exploit code exists, and the commands run in the application's context, letting the attacker read datasource credentials and model API keys and pivot further. Because no user interaction and no admin role are required, any compromised or self-registered low-privilege account is sufficient.