CVE-2026-77521: MaxKB agents get a shell tool with no human approval, scored 10.0

NVD·high signalXBlueskyLinkedInCopy link

NVD published CVE-2026-77521 on 2026-09-21 at CVSS 10.0 critical. In MaxKB before 2.10.5-lts, any assistant with a tool, MCP tool, skill or sub-application uses SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so the human-approval interrupt never fires. Untrusted chat text or ingested content can therefore reach command execution, and source deployments with MAXKB_SANDBOX disabled run those commands as the application user. The failure is not a missing sandbox but a missing entry in an approval list, which is the same shape as the subagent permission-scoping bugs across terminal agents this month.