CVE-2026-37751

CriticalCVSS 9.8

Published: 28/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Summary

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.

Risk Assessment

The risk is that an attacker can execute arbitrary commands on the server, potentially leading to full system compromise or data breach.

Recommendation

Update to a non-vulnerable version and validate/sanitize input before use in killSessionSync.

Original NVD description (English source)

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.