MaxKB CVE-2026-79918

Requires an authenticated MaxKB user (PR:L) who can execute tool code within the ToolExecutor LD_PRELOAD sandbox - i.e. the deployment must expose a tool/agent feature that runs attacker-influenced code. Limited to versions prior to 2.10.6-lts. The sandbox's LD_PRELOAD shim (installer/sandbox.c) must be the active subprocess-restriction mechanism; the escape works specifically because fexecve was not among the hooked syscalls (execve/execvpe/execveat were). Exploitation is meaningless without the ability to run code inside the sandbox in the first place, so this is a defense-in-depth escape rather than an initial-access vector.

This is a protection-mechanism bypass (CWE-693): the MaxKB ToolExecutor uses an LD_PRELOAD C shim (installer/sandbox.c) that hooks execve, execvpe, and execveat to block subprocess creation, but omitted fexecve - so an attacker who can already run tool code inside the sandbox can spawn a process outside the intended policy. The vendor CVSS of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) is reasonable but understates the nature of the flaw: this is a sandbox escape, and once the subprocess barrier is defeated the practical outcome is closer to arbitrary command execution on the host than the 'Low' C/I/A partial-impacts suggest. The mitigating reality is the precondition - the attacker must ALREADY be authenticated (PR:L) AND able to execute code inside a ToolExecutor sandbox, i.e. the sandbox is defense-in-depth around a feature that already runs semi-trusted code, so this is a hardening/escape bug rather than a direct remote-unauth RCE. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data; the fix is confirmed by the vendor GHSA advisory and commit. Net: a real but conditional issue - patch-worthy for anyone exposing configurable code-execution tools, not a mass-exploitation emergency. The input tag 'Information Disclosure' mislabels this - it is a sandbox/subprocess-policy escape, not primarily a confidentiality leak.

An authenticated MaxKB user who can supply or run tool code within the ToolExecutor sandbox writes code that opens a file descriptor to an executable and calls fexecve() instead of execve(), which the LD_PRELOAD shim never hooked. The call bypasses the subprocess-creation policy and launches a process outside the sandbox, giving the attacker code execution beyond the intended tool boundary. No public exploit is identified at time of analysis, though the mechanism is trivially reproducible from the commit diff.