Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2025-64703

MaxKB has Information Leak in sandbox

MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
1panel Maxkb
Products
Maxkb Maxkb
CVE-2025-48950

MaxKB Python Sandbox Bypass in Function Library

MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as `/bin,/usr/bin`, etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directories to carry out attacks. Version 1.10.8-lts fixes the issue.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Maxkb
Products
Maxkb
CVE-2025-53928

MaxKB has RCE in MCP call

MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. Versions 1.10.9-lts and 2.0.0 fix the issue.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Maxkb
Products
Maxkb
CVE-2025-53927

MaxKB sandbox bypass

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. Therefore, an attacker can use the `shutil.copy2` method in Python to copy the command they want to execute to the executable directory. This bypasses directory restrictions and reverse shell. Version 2.0.0 fixes the issue.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Maxkb
Products
Maxkb
CVE-2024-56137

MaxKB RCE vulnerability in function library

MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Maxkb
Products
Maxkb
CVE-2025-4546

1Panel-dev MaxKB Knowledge Base Module csv injection

A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.10.8 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Maxkb
Products
Maxkb