What is the CVSS score of EUVD-2026-42924?

EUVD-2026-42924 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of MaxKB are affected by EUVD-2026-42924?

MaxKB (1Panel-dev's enterprise AI assistant) versions before 2.10.0-lts allow authenticated users to execute arbitrary commands on servers by uploading malicious tool files, creating insider threat…. A patch is available.

How to fix or mitigate EUVD-2026-42924?

24 hours: Identify MaxKB deployments and verify affected versions (<2.10.0-lts); restrict tool file import permissions to system administrators only. 7 days: Enable audit logging for MCP transport and tool imports; isolate MaxKB from critical business systems; review access logs for suspicious imports. 30 days: Monitor 1Panel-dev releases for patched versions (2.10.0-lts or later); test in staging; deploy upgrades. Context: no public exploit identified at time of analysis.

MaxKB EUVD-2026-42924

| CVE-2026-54149 HIGH

OS Command Injection (CWE-78)

2026-07-10 GitHub_M

Command Injection Maxkb 1Panel Dev

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable web app, low complexity, but requires an authenticated account to import/reference the tool (PR:L); stdio command execution yields full host C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 10, 2026 - 17:01 EUVD

Analysis Generated

Jul 10, 2026 - 16:20 vuln.today

DescriptionCVE.org

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP referencing mode in apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file containing stdio transport with malicious commands and trigger the configuration through an AI Chat node so MultiServerMCPClient executes arbitrary system commands. This issue is fixed in version 2.10.0-lts.

AnalysisAI

OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated user achieve arbitrary command execution on the host by importing a crafted .tool file that declares an MCP stdio transport and triggering it through an AI Chat node. Because the tool-import path (apps/tools/serializers/tool.py) and the MCP referencing path (base_chat_step.py) fail to consistently validate the MCP transport type, the MultiServerMCPClient spawns the attacker's stdio command locally. Rated CVSS 8.8; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

MaxKB integrates external tools via the Model Context Protocol (MCP), which supports multiple transports including network-style transports and a 'stdio' transport that launches a local subprocess and communicates over stdin/stdout. The vulnerability is a CWE-78 OS command injection: the .tool import serializer and the MCP referencing logic in the chat pipeline do not enforce which transport types are permitted, so a stdio transport definition carrying an arbitrary command/args is accepted and later executed by langchain-mcp's MultiServerMCPClient when the referencing AI Chat node runs. Per CPE cpe:2.3:a:1panel-dev:maxkb, only the MaxKB application itself is affected. The root cause is missing allow-listing/validation of the transport field, allowing user-controlled data to reach a process-spawning sink.

RemediationAI

Vendor-released patch: upgrade to MaxKB 2.10.0-lts, which enforces MCP transport-type validation (see GHSA-4pr3-9xhm-98x5 and the release notes at https://github.com/1Panel-dev/MaxKB/releases/tag/v2.10.0-lts). If immediate upgrade is not possible, restrict tool-import and application-editing capabilities to trusted administrators only and audit existing .tool definitions for stdio transports carrying shell commands, deleting any that are unexpected; note this reduces functionality for legitimate power users who build custom tools. Additionally, place MaxKB behind authenticated network controls and run the service as a low-privileged, sandboxed/containerized user with minimal host access so that a successful stdio spawn cannot escalate beyond the container - the trade-off is that some MCP tools expecting broader host access may stop working. Do not expose the MaxKB admin/tool interfaces to untrusted networks until patched.