CVE-2026-37751
An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.
- Published Aug 28, 2026
- CVSS 9.8 critical
- 2.9% chance of exploitation in the next 30 days (EPSS)
- A fix is available