HIGH 8.7 NVD
CVE-2026-77926
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.
References
- https://github.com/apconw/Aix-DB/blob/5d370adf3e695fc8b11137e5beeb01973cb46810/agent/commo
- https://www.lasso.security/vulnerability-database/cve-2026-77926
- https://www.vulncheck.com/advisories/aix-db-1.2.4-authenticated-rce-via-chatbi-common-agen
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-20 via NVD.
vulnfeed aggregates 17400 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.