---
id: "CVE-2026-77926"
kind: "vulnerability"
aliases: ["CVE-2026-77926"]
title: "Aix-DB: authenticated users can run OS commands via ChatBI agent"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Aix-DB", "fixed": [], "affected": "= 1.2.4", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-tooling", "aix-db", "llm-agents", "prompt-injection", "rce", "self-hosted"]
not_affected_if: ["auth-required", "unknown"]
published_at: "2026-10-20T01:17:19+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:35:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77926", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:35:16+00:00"}]
---

# Aix-DB: authenticated users can run OS commands via ChatBI agent

Aix-DB 1.2.4's ChatBI common agent is built on deepagents with LocalShellBackend(inherit_env=True), with no approval gate or excluded tools. This gives it a host shell execute tool. Any logged-in user can run OS commands as the server user by sending a chat message to the get_answer endpoint, or by uploading a document with injected text. The commands inherit datasource credentials, DB connection strings and model API keys. No fixed version is published and exploitation in the wild is not reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:Aix-DB affected = 1.2.4 fixed ?

## How to check

Run 'docker image ls' or check the release tag to see if you run Aix-DB 1.2.4 (or a build from commit 5d370ad). Then check agent/common/enhanced_common_agent.py around lines 221-259 for LocalShellBackend without excluded_tools or interrupt_on. Review chat logs for shell commands such as id or env.

## Fix

No fixed release as of 2026-10-23 (v1.2.4 is the latest). Mitigations from Lasso: replace LocalShellBackend with a non-execution backend, or run it in a container/VM sandbox without inherit_env; exclude execute and gate it with interrupt_on (excluded_tools alone is not enough). Until patched, restrict Aix-DB logins to trusted users, keep it off the internet, and rotate datasource and model API keys if untrusted users had access.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77926
- 2026-10-23T22:35:16+00:00 analyst — Read Lasso (finder) and VulnCheck advisories plus GitHub releases: only 1.2.4 listed affected, no fixed release found (1.2.4 is latest). No public exploit tooling, but Lasso describes a PoC (chat prompt running id). No X search done. Lasso scores 9.9 critical, CNA 8.7 high; severity left unchanged.

## Documents

- [advisory] Lasso: Prompt-Injectable Host Shell Execution in ChatBI Agent (CVE-2026-77926) https://www.lasso.security/vulnerability-database/cve-2026-77926
- [advisory] VulnCheck: Aix-DB 1.2.4 Authenticated RCE https://www.vulncheck.com/advisories/aix-db-1.2.4-authenticated-rce-via-chatbi-common-agent-execute-tool
- [describes] Aix-DB releases (latest v1.2.4) https://github.com/apconw/Aix-DB/releases

## From the sources

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_