MaxKB agent prompt injection command execution vulnerability disclosure

MaxKB published a security advisory (CVE-2026-77521 / GHSA-f36j-f34j-h3rx) stating that any assistant with mounted tools, MCP tools, skills, or sub-apps processes conversations through an agent built with deepagents, and that agent uses the host shell backend SandboxShellBackend, which automatically exposes the execute tool. MaxKB neither removes it via excluded_tools nor requires manual confirmation for it in interrupt_on. Therefore, untrusted conversations or indirect prompt injection via RAG or uploaded documents can drive the model to execute shell commands. The affected scope is marked as <= 2.10.3-lts, and it is considered that all versions building chat agents based on deepagents and SandboxShellBackend may be affected. The vulnerability was reported by Lasso Security.