What happened
Published 2026-09-21 as part of the continued MaxKB sandbox-hardening cluster (following the CVE-2026-39418/39419/39420/39421 series earlier in 2026). Both bypasses require prior authenticated ability to execute tool code.
Why it matters
MaxKB's tool sandbox is the isolation boundary that turns prompt injection into contained tool use rather than host execution; each bypass moves an AI-assistant tool-execution flaw back toward host RCE, so operators should treat the whole sandbox as layered, not absolute.
Attack vector
Two distinct sandbox gaps: (1) CVE-2026-79918 — the hook set covers execve/execvpe/execveat but not fexecve, so sandboxed tool code can start processes via fexecve; (2) CVE-2026-79919 — sandboxed function-library code can invoke ctypes.CDLL from an importlib MetaPathFinder callback (a Python import frame defeats the dlopen call-stack heuristic) and use unhooked dlsym to break out.
Affected systems
MaxKB (1Panel-dev) < 2.10.6-lts (CVE-2026-79919 also covered: < 2.10.6-lts)
Mitigation
Upgrade to v2.10.6-lts (commits 6fa7947a and d4bd22af; GHSA-9mh9-v949-fwqh).