CVE-2026-77926 — Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated …
Published: 2026-10-20 · CVSS: 8.7 · CVSS 4.0
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7