CVE-2026-37751: ai-maestro OS Command Injection RCE Flaw

CVE-2026-37751 Overview

CVE-2026-37751 is an OS command injection vulnerability [CWE-78] in the killSessionSync function located in lib/agent-runtime.ts of 23blocks-OS ai-maestro version 0.24.17. The flaw allows unauthenticated attackers to execute arbitrary operating system commands by supplying crafted input to the vulnerable function. ai-maestro is a browser-based dashboard that orchestrates multiple AI coding agents such as Claude Code, Aider, Cursor, and GitHub Copilot. The vulnerability was patched in version 0.24.18 through commit 06d54f0, which addresses remote code execution in tmux session management.

Critical Impact
Remote, unauthenticated attackers can achieve arbitrary command execution on the host running ai-maestro, leading to full system compromise and access to connected AI agent credentials.

Affected Products

23blocks-OS ai-maestro version 0.24.17
Deployments exposing the ai-maestro dashboard to untrusted networks
Environments integrating tmux-based session management via lib/agent-runtime.ts

Discovery Timeline

2026-08-28 - CVE-2026-37751 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-37751

Vulnerability Analysis

The vulnerability resides in the killSessionSync function within lib/agent-runtime.ts, part of ai-maestro's tmux session management layer. The function passes user-influenced input into an OS command execution path without adequate sanitization or argument isolation. Attackers can inject shell metacharacters into the input to break out of the intended command context and execute arbitrary system commands.

Because ai-maestro orchestrates multiple AI coding agents with access to source code repositories, API keys, and developer tooling, successful exploitation extends beyond the host. Attackers can pivot to connected agent credentials, exfiltrate source code, and manipulate automated coding pipelines.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The killSessionSync function constructs a shell command using attacker-controllable data — a tmux session identifier — and executes it through a shell interpreter. Without allowlisting or safe argument passing, characters such as ;, |, &&, and backticks let attackers append arbitrary commands.

Attack Vector

Exploitation occurs over the network against exposed ai-maestro instances. No authentication or user interaction is required. An attacker crafts a request that reaches the tmux session management routine with a malicious session identifier, triggering command execution with the privileges of the ai-maestro process.

text

// Patch reference from commit 06d54f0687ad1fc5898a688a92f7e1f2df56c475
// fix: patch RCE command injection in tmux session management (v0.24.18)
-      "softwareVersion": "0.24.17",
+      "softwareVersion": "0.24.18",

Source: GitHub Commit 06d54f0

The upstream commit bumps the shipped version metadata from 0.24.17 to 0.24.18 alongside code changes that sanitize tmux session parameters before invocation. For the complete advisory, see GHSA-mf7j-vfrr-jmfh and the CVE research writeup.

Detection Methods for CVE-2026-37751

Indicators of Compromise

Unexpected child processes spawned by the Node.js runtime hosting ai-maestro, particularly sh, bash, or tmux invocations containing shell metacharacters
Outbound network connections from the ai-maestro host to unfamiliar destinations following API requests to session management endpoints
Modifications to files under agent working directories or SSH keys, tokens, and configuration files accessible to the ai-maestro process
Anomalous tmux session names containing characters such as ;, |, `, or $(

Detection Strategies

Inspect HTTP request bodies and query parameters directed at ai-maestro session endpoints for shell metacharacters in session identifier fields
Correlate process ancestry to identify shell processes whose parent is the ai-maestro Node.js binary but whose command line does not match legitimate tmux operations
Alert on version banner responses reporting 0.24.17 or earlier when queried against production inventories

Monitoring Recommendations

Enable command-line auditing (auditd on Linux) for the account running ai-maestro and forward events to a centralized log platform
Monitor egress traffic from ai-maestro hosts and flag connections that do not match the expected AI provider endpoints
Track integrity of lib/agent-runtime.ts and installed package versions to detect downgrade attempts

How to Mitigate CVE-2026-37751

Immediate Actions Required

Upgrade 23blocks-OS ai-maestro to version 0.24.18 or later, which contains the fix from commit 06d54f0
Restrict network exposure of the ai-maestro dashboard to trusted management networks or place it behind an authenticating reverse proxy
Rotate any API keys, tokens, or credentials stored on or reachable from the ai-maestro host if the instance was exposed while running 0.24.17
Review tmux session history and shell audit logs for evidence of unauthorized command execution

Patch Information

The vendor released version 0.24.18 with the patch in commit 06d54f0687ad1fc5898a688a92f7e1f2df56c475. Refer to the GitHub Security Advisory GHSA-mf7j-vfrr-jmfh for the authoritative fix details.

Workarounds

Block network access to ai-maestro session management endpoints at the reverse proxy or firewall until the upgrade is applied
Run ai-maestro under a dedicated, least-privileged system account with no access to sensitive credential stores
Deploy an application-layer filter that rejects request payloads containing shell metacharacters in session identifier fields

bash

# Upgrade ai-maestro to the patched release
git -C /opt/ai-maestro fetch --tags
git -C /opt/ai-maestro checkout v0.24.18
npm install --production
systemctl restart ai-maestro

# Verify the running version
curl -s http://127.0.0.1:PORT/ | grep -i 'softwareVersion'