CVE-2026-37751 - An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input

Back Back to CVE browser

CRITICAL

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input

Published Aug 28, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 2.94%

Description

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.

Affected products

Remediation

No remediation recorded yet.

Metrics

2.94% 0.02939

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.02939

Score over time

Aug-Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (3 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	2.94% (0.02939)	86.65th	v5 (v2026.06.15)
Oct 1, 2026	2.94% (0.02939)	86.63th	v5 (v2026.06.15)
Aug 29, 2026	1.60% (0.01605)	73.72th	v5 (v2026.06.15)

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

Link	Providers	Tags
https://github.com/23blocks-OS/ai-maestro/commit/06d54f0687ad1fc5898a688a92f7e1f2df56c475
https://github.com/23blocks-OS/ai-maestro/security/advisories/GHSA-mf7j-vfrr-jmfh
https://github.com/rajukani100/CVE-research/tree/main/ai-maestro-rce-advisory		exploit