{"data":{"id":"304b31eb-5d86-4e36-8a1e-46e1756cd6b1","title":"CVE-2026-77926: Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating…","summary":"Aix-DB 1.2.4 contains CVE-2026-77926, a remote code execution flaw. Authenticated non-admin users can run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Crafted chat input sent to POST /dify/get_answer, or documents uploaded with malicious text, can run host commands and expose datasource credentials and model API keys.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77926","publishedAt":"2026-10-20T01:17:19.213Z","cveId":"CVE-2026-77926","cweIds":["CWE-749"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Aix-DB 1.2.4","ChatBI common agent","deepagents execute tool","Dify"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Aix-DB remote code execution through ChatBI common agent execute tool","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-20T06:15:30.062Z","kevDateAdded":null,"advisoryAliases":["GHSA-m2vr-p43p-p3h6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-20T06:15:33.320Z","patchAvailable":null,"disclosureDate":"2026-10-20T01:17:19.213Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"]}}