EUVD-2026-22191Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandbox result validation and spoof tool execution results by exploiting Python frame introspection to read the wrapper's UUID from its bytecode constants, then writing a forged result directly to file descriptor 1 (bypassing stdout redirection). By calling sys.exit(0), the attacker terminates the wrapper before it prints the legitimate output, causing the MaxKB service to parse and trust the spoofed response as the genuine tool result. This issue has been fixed in version 2.8.0.
AnalysisAI
MaxKB versions 2.7.1 and below allow authenticated users to spoof tool execution results by exploiting Python frame introspection to extract the wrapper's UUID from bytecode, then writing forged output directly to file descriptor 1 to bypass stdout redirection and terminate the wrapper process before legitimate output is generated, causing the service to trust the attacker-controlled response. This integrity bypass requires prior authentication and local/network access but enables attackers to manipulate AI tool results without detection. The vulnerability has been patched in version 2.8.0.
Technical ContextAI
MaxKB implements a sandbox execution wrapper for AI-generated tool calls that redirects and validates tool outputs. The vulnerability exploits Python's introspection capabilities-specifically the ability to access bytecode constants via the sys._getframe() API-to read the unique identifier embedded in the wrapper's compiled code. By writing directly to file descriptor 1 (the underlying file object before Python's stdout redirection layer), an authenticated attacker bypasses output validation mechanisms. The attacker then calls sys.exit(0) to terminate the wrapper process immediately, preventing the legitimate tool output from being captured and parsed. This leaves only the forged result in the validation pipeline, which MaxKB trusts as genuine. The root cause is insufficient isolation between the wrapper process and untrusted code execution, combined with reliance on stdout redirection rather than cryptographic result attestation. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) categorizes this as a validation bypass in a data pipeline.
RemediationAI
Upgrade MaxKB to version 2.8.0 or later immediately. The fix has been released and is available via the official GitHub releases page (https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0). The patch commit 38c4cfecd065293ede0437f6fa76cf0116591d25 hardens the wrapper's result validation to prevent frame introspection and file descriptor manipulation. If immediate upgrade is not possible, restrict authenticated user access to tool definition creation and monitor LLM prompt injection attempts, though this is not a substitute for patching. Review audit logs for suspicious tool result patterns (e.g., execution results appearing before tool invocation timestamps) as a temporary detection measure.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today