Sandbox Bypass in MaxKB Open-Source AI Assistant by 1Panel

CVE-2025-53927

What is CVE-2025-53927?

MaxKB, an open-source AI assistant developed by 1Panel, is susceptible to a sandbox bypass vulnerability in versions prior to 2.0.0. The vulnerability arises because the system only enforces execution permissions within a designated directory. This limitation allows an attacker to exploit the shutil.copy2 method in Python to transfer malicious commands to an executable directory, circumventing existing directory restrictions. Consequently, this can lead to unauthorized command execution, including the deployment of reverse shells. Users are advised to upgrade to version 2.0.0 or later, where this issue has been addressed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References