CVE-2026-37751: n/a

This vulnerability exists in the killSessionSync function within lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17. It allows remote attackers to perform OS command injection by providing specially crafted input, leading to arbitrary command execution. The CVSS 3.1 base score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. No official remediation or patch has been documented as of the publication date.

Successful exploitation can lead to full system compromise including unauthorized command execution, complete loss of confidentiality, integrity, and availability of the affected system. Given the nature of OS command injection, attackers can execute arbitrary commands with the privileges of the vulnerable application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable function to untrusted inputs and consider implementing input validation or other protective controls if feasible.