cve/2024/CVE-2024-56137.md

### [CVE-2024-56137](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56137)
![](https://img.shields.io/static/v1?label=Product&message=MaxKB&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)

### Description

MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.

### POC

#### Reference
- https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-76w2-2g72-cg85

#### Github
No PoCs found on GitHub currently.