{"uuid": "8ca01156-b92f-48f9-b402-821511de9488", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77521", "type": "seen", "source": "https://t.me/pphm_HackerNews/3255", "content": "\ud83d\udd34 Critical MaxKB AI Agent Flaw Lets Prompt Injection Execute System Commands\n\nA critical vulnerability in the MaxKB AI knowledge-base platform could let attackers exploit prompt injection and run operating system commands on vulnerable deployments, including directly on the underlying host in some configurations.\n\nThis flaw, tracked as CVE-2026-77521 and GHSA-f36j-f34j-h3rx, affects MaxKB versions up to and including 2.10.3-lts. The issue has received a maximum CVSS v3.1 score of 10.0 for public or embedded assistants that can be accessed without authentication. The patch for this vulnerability is included in MaxKB version 2.10.5-lts.", "creation_timestamp": "2026-09-22T18:09:01.000000Z"}