CVEvulnerability

CVE-2025-66419

10.0 CRITICAL Published 2025-12-11 Modified 2026-10-07 Official page ↗

Status: Analyzed
Published: 2025-12-11
Last modified: 2026-10-07
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected]): 10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses: CWE-362

Description

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.

Affected configurations

• maxkb maxkb (< 2.4.0)

Weakness · CWE (1)

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References

https://github.com/1Panel-dev/MaxKB/commit/f8ada9a110c4dbef8c3c2636c78847ecd621ece7 Patch
https://github.com/1Panel-dev/MaxKB/releases/tag/v2.4.0 Release Notes
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f9qm-2pxq-fx6c Vendor Advisory

CVE-2025-66419

Description

Affected configurations

Related

Weakness · CWE (1)

References