What happened
Disclosed via GitHub Security Advisory and NVD on 2026-09-21 (reported 2026-07-08). SandboxShellBackend exposes an execute-shell tool that is not excluded from agent tool sets and is omitted from the human-approval interrupt_on list. Untrusted chat or ingested (RAG) content can therefore reach arbitrary command execution, with two distinct sandbox-escape paths depending on the deployment flavor.
Why it matters
This is a chain of two of the highest-impact AI-specific attack classes: indirect prompt injection (OWASP LLM01) delivering remote code execution against an enterprise AI assistant, including the container image running as root. An attacker needs no account — just a message or a poisoned document the agent retrieves.
Attack vector
A remote user sends untrusted chat/ingested content containing a prompt injection; the SandboxShellBackend exposes an 'execute shell' tool (not excluded, not in interrupt_on) so no human approval is needed. On source installs with MAXKB_SANDBOX disabled the command runs as the application user; in the official root container, a string-based gosu wrapper permits shell metacharacters to execute outside the sandbox.
Affected systems
MaxKB (1Panel-dev) < 2.10.5-lts
Mitigation
Upgrade to v2.10.5-lts (fix commit 594f50f2; GHSA-f36j-f34j-h3rx). Keep MAXKB_SANDBOX enabled and do not expose assistants to untrusted chat content until patched.