External risk intelligence

23blocks-OS ai-maestro OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-37751

The vulnerability exists in an agent-runtime component used in an AI-focused product. Such components are commonly deployed as web-based or network-accessible services to facilitate AI operations, making them plausible candidates for public-facing API or service endpoints.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the ai-maestro technology that could allow unauthorized execution of commands. This issue stems from how the system handles specific inputs, potentially enabling external actors to run arbitrary code. The primary concern is to confirm if this technology is in use within our environment and to what extent it may be exposed.

Command execution flaw found in AI software.
Critical risk; could allow external control.
Confirm usage and exposure impact.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending specially crafted input to the agent-runtime component of ai-maestro. Since there are no requirements for authentication or user interaction, an unauthenticated attacker can exploit this by directly interacting with the vulnerable function over the network. Successful exploitation allows the attacker to run arbitrary commands on the system.

No authentication or user interaction needed.
Crafted input to killSessionSync function.
Arbitrary command execution on system.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to execute arbitrary commands on the affected system by sending specially crafted input to the killSessionSync function. When supported by the advisory, this could impact system data and service behavior.

System commands and data could be compromised.
Via crafted network input to the function.
Unspecified system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

An OS command injection vulnerability in the killSessionSync function of 23blocks-OS ai-maestro requires immediate attention from teams managing the AI Maestro platform and its underlying infrastructure. The first practical step is to identify all instances of ai-maestro, determine their exposure (especially any network-accessible deployments), and confirm their criticality to business operations. This will enable an assessment of the potential impact and facilitate coordinated remediation planning with the responsible application or platform owners.

Platform or application owners should lead remediation.
Verify ai-maestro instances and exposure.
Plan and coordinate risk-based action.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is 23blocks-OS ai-maestro?

23blocks-OS ai-maestro is an AI-focused software platform. It includes an agent-runtime component designed to manage AI operations, often acting as a bridge between user requests and underlying system processes to facilitate automated tasks.

What does OS command injection mean for CVE-2026-37751?

This vulnerability falls under the CWE-78 weakness class, which happens when an application passes unsafe user input directly to a system shell. In this case, the `killSessionSync` function fails to sanitize data, allowing an attacker to insert their own commands that the operating system then executes with the same privileges as the ai-maestro service.

How is this command injection triggered?

An attacker triggers this by sending a specially crafted input string to the `killSessionSync` function within the agent-runtime. No authentication or prior user interaction is required to initiate this process. Simply navigating to or interacting with a network endpoint that processes this function with malicious input is sufficient; standard system operations that do not involve passing input to this specific function are not affected.

Is my deployment of ai-maestro at risk?

According to Halo Surface Signal, this vulnerability is classified as likely to be exposed because ai-maestro's agent-runtime is typically deployed as a network-accessible service to support AI workflows. If your instance is reachable over the internet or through an untrusted network, it is at higher risk of being targeted than an isolated, internal-only service.

What should I do if I run ai-maestro?

Begin by creating an inventory of all ai-maestro instances within your environment. Identify which installations are accessible over the network versus those that are internal. Once mapped, coordinate with your infrastructure or application owners to prioritize these systems for remediation, ensuring that any exposed endpoints are secured or taken offline while a fix is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.