A critical OS command injection vulnerability in 23blocks-OS ai-maestro version 0.24.17 allows unauthenticated remote attackers to achieve full system compromise.

The vulnerability exists within the killSessionSync function located in lib/agent-runtime.ts, where improper neutralization of special elements allows for OS command injection. This flaw is accessible to unauthenticated attackers over the network.

With a CVSS score of 9.8, this vulnerability represents the highest level of risk to organizational infrastructure. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the application, potentially leading to complete data exfiltration, unauthorized system control, and significant operational disruption.

Immediate Action: Apply the vendor-provided patch by updating ai-maestro to the version containing the fix identified in the GitHub security advisory (GHSA-mf7j-vfrr-jmfh).

Proactive Monitoring: Review system and application logs for suspicious process execution patterns or unexpected shell commands originating from the ai-maestro runtime environment.

Compensating Controls: Implement strict network ingress filtering and utilize a Web Application Firewall (WAF) to inspect incoming traffic for command injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's advisory linked in the references.

Given the critical severity and the presence of a public proof-of-concept, immediate remediation is required to secure the environment. Administrators should verify their current version of ai-maestro and apply the necessary updates immediately to prevent unauthorized remote code execution.