{"id":"CVE-2026-77926","kind":"vulnerability","aliases":["CVE-2026-77926"],"related":[],"title":"Aix-DB: authenticated users can run OS commands via ChatBI agent","description":"Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.","summary":"Aix-DB 1.2.4's ChatBI common agent is built on deepagents with LocalShellBackend(inherit_env=True), with no approval gate or excluded tools. This gives it a host shell execute tool. Any logged-in user can run OS commands as the server user by sending a chat message to the get_answer endpoint, or by uploading a document with injected text. The commands inherit datasource credentials, DB connection strings and model API keys. No fixed version is published and exploitation in the wild is not reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Aix-DB","fixed":[],"affected":"= 1.2.4","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","aix-db","llm-agents","prompt-injection","rce","self-hosted"],"not_affected_if":["auth-required","unknown"],"how_to_check":"Run 'docker image ls' or check the release tag to see if you run Aix-DB 1.2.4 (or a build from commit 5d370ad). Then check agent/common/enhanced_common_agent.py around lines 221-259 for LocalShellBackend without excluded_tools or interrupt_on. Review chat logs for shell commands such as id or env.","fix":"No fixed release as of 2026-10-23 (v1.2.4 is the latest). Mitigations from Lasso: replace LocalShellBackend with a non-execution backend, or run it in a container/VM sandbox without inherit_env; exclude execute and gate it with interrupt_on (excluded_tools alone is not enough). Until patched, restrict Aix-DB logins to trusted users, keep it off the internet, and rotate datasource and model API keys if untrusted users had access.","status":"open","published_at":"2026-10-20T01:17:19+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:32:57+00:00","updated_at":"2026-10-23T22:35:16+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:32:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Aix-DB: authenticated users can run OS commands via ChatBI agent","impact":"high","summary":"Aix-DB 1.2.4 lets any logged-in non-admin user run operating system commands on the host through the ChatBI agent's execute tool. An attacker can also plant malicious text in uploaded documents or chat input to trigger it, exposing datasource credentials and model API keys.","category":"ai-tooling","who_cares":["aix-db","self-hosted","llm-agents"],"confidence":0.6,"needs_auth":"yes","worst_case":"Host commands run as the app user; datasource credentials and API keys leak.","analyst_note":"Check the NVD entry and the Aix-DB project for a fixed version and whether the ChatBI execute tool can be disabled; sources give no fix or check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00048,"input_tokens":2936,"output_tokens":372,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Aix-DB project for a fixed version and whether the ChatBI execute tool can be disabled; sources give no fix or check steps.","search":"'-2026':14A,17A '-77926':15A,18A '/dify/get_answer':166C '1.2.4':41B,129C 'admin':141C 'agent':12A,30B,45B,152C 'ai':23B 'ai-tool':22B 'aix':2A,20A,26B,39B,127C 'aix-db':1A,19A,25B,38B,126C 'allow':137C 'answer':91B 'api':111B,182C 'approv':57B 'attack':158C 'authent':4A,138C 'built':47B 'chat':86B,162C 'chatbi':11A,43B,150C 'code':133C 'command':9A,78B,102B,147C,176C 'common':44B,151C 'connect':107B 'contain':130C 'craft':161C 'credenti':105B,179C 'cve':13A,16A 'datasourc':104B,178C 'db':3A,21A,27B,40B,106B,128C 'deepag':49B,155C 'document':97B,169C 'endpoint':92B 'env':53B 'exclud':60B 'execut':68B,134C,156C 'exploit':119B 'expos':177C 'fix':114B 'gate':58B 'get':90B 'give':63B 'host':37B,66B,175C 'inherit':52B,103B 'inject':33B,99B 'input':163C 'key':112B,183C 'llm':29B 'llm-agent':28B 'localshellbackend':51B 'log':72B 'logged-in':71B 'malici':171C 'messag':87B 'model':110B,181C 'non':140C 'non-admin':139C 'oper':145C 'os':8A,77B 'post':165C 'prompt':32B 'prompt-inject':31B 'publish':117B 'rce':34B 'remot':132C 'report':125B 'run':7A,76B,144C,174C 'self':36B 'self-host':35B 'send':84B,160C 'server':81B 'shell':67B 'string':108B 'system':146C 'text':100B,172C 'tool':24B,61B,69B,157C 'true':54B 'ungat':154C 'upload':95B,168C 'user':5A,74B,82B,142C 'version':115B 'via':10A 'vulner':135C 'wild':122B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77926","severity":null,"published_at":"2026-10-20T01:17:19+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-77926:253","url":null,"severity":null,"published_at":"2026-10-23T22:35:16+00:00","modified_at":"2026-10-23T22:35:16+00:00","first_seen_at":"2026-10-23T22:35:16+00:00","fetched_at":"2026-10-23T22:35:16+00:00","note":"Read Lasso (finder) and VulnCheck advisories plus GitHub releases: only 1.2.4 listed affected, no fixed release found (1.2.4 is latest). No public exploit tooling, but Lasso describes a PoC (chat prompt running id). No X search done. Lasso scores 9.9 critical, CNA 8.7 high; severity left unchanged."}],"documents":[{"id":1519,"url":"https://www.lasso.security/vulnerability-database/cve-2026-77926","title":"Lasso: Prompt-Injectable Host Shell Execution in ChatBI Agent (CVE-2026-77926)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1522,"url":"https://www.vulncheck.com/advisories/aix-db-1.2.4-authenticated-rce-via-chatbi-common-agent-execute-tool","title":"VulnCheck: Aix-DB 1.2.4 Authenticated RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1525,"url":"https://github.com/apconw/Aix-DB/releases","title":"Aix-DB releases (latest v1.2.4)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}