GitHub Advisoryadvisory · PyPI

GHSA-7xcv-9j6c-2fmc Modular Max Serve has Unsafe Deserialization vulnerability

CRITICAL Published 2025-11-18 Modified 2025-11-18 Official page ↗
Aliases
CVE-2025-60455
Ecosystem
PyPI
Packages
modular
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-502
Reviewed
2025-11-18

Affected packages

• PyPI modular: < 25.6.0 → fixed in 25.6.0

Description

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

Related

Alias · CVE (1)

  • CVE-2025-60455 Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References