Aix-DB: Authenticated remote code execution via ChatBI agent shell tool
Summary
Aix-DB 1.2.4 contains a flaw in its ChatBI common agent, which exposes an ungated shell execution tool running directly on the server host. Any authenticated non-admin user can trigger operating system commands by sending crafted chat input to POST /dify/get_answer or by uploading documents containing malicious text. Successful exploitation can expose datasource credentials and LLM API keys held in the server environment. No fixed version has been published yet.
Affected
- Aix-DB 1.2.4 (range 1.2.4 to <= 1.2.4 per CNA record; earlier versions unknown)
Fixed in
- Unknown. No vendor advisory or patch has been confirmed.
Workaround
- Do not use the host LocalShellBackend; build the agent with a non-execution backend so the execute tool is not added.
- If shell execution is required, run it in an isolated container or VM without inherit_env=True.
- Restrict who has a login and disable self-registration.
- Keep datasource credentials and API keys out of the process environment where possible, and rotate them if untrusted users had access.
Exploitation
- Public technical details exist (Lasso and VulnCheck write-ups); no public exploit repository was found.
- CISA SSVC: exploitation status 'poc', automatable: no, technical impact: total.
- No evidence of exploitation in the wild; not listed in KEV.
Our recommendation
- Check whether Aix-DB 1.2.4 is deployed, especially for multiple users or internet-facing instances.
- Apply the workarounds above immediately, starting with removing host shell execution.
- Monitor the upstream repository for a fixed release and update as soon as one is available.
- Review logs for unusual commands run by the service process and rotate exposed credentials if compromise is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-77926 Lasso Security vulnerability database www.lasso.security
- VulnCheck advisory: Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool www.vulncheck.com
- Aix-DB enhanced_common_agent.py at commit 5d370adf github.com
- Strix CVE-2026-77926 www.strix.ai
- OpenCVE CVE-2026-77926 app.opencve.io
- VulDB CVE-2026-77926 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:36.
Original description (NVD)
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.