Apconw
CVE-2026-77926: Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common
CVE-2026-77926 Oct 20, 2026 Source: Vendor
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-77926
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-77926
BR2026-0000-028399
unclaimed
Credited as Noy Pearl
CVE-2026-77926
BR2026-0000-028400
unclaimed
Credited as Michael Sromin
CVE-2026-77926
BR2026-0000-028401
unclaimed
Credited as Ophir Dror