VulnerabilityAnalyzed

CVE-2025-66419

In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions.

CRITICAL 10.0EPSS 0.31%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.

CVSS 3.1: 10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.31% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-362
Affected: maxkb/maxkb
Source: security-advisories@github.com

References

https://github.com/1Panel-dev/MaxKB/commit/f8ada9a110c4dbef8c3c2636c78847ecd621ece7Patch
https://github.com/1Panel-dev/MaxKB/releases/tag/v2.4.0Release Notes
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f9qm-2pxq-fx6cVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.