CVE-2025-66419

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66419
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66419.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66419
Aliases
  • GHSA-f9qm-2pxq-fx6c
Published
2025-12-11T21:39:15.361Z
Modified
2026-03-01T02:54:49.633604Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
MaxKB vulnerable to privilege escalation through sandbox bypass
Details

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.

Database specific 
{
    "cwe_ids": [
        "CWE-362"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66419.json"
}
References

Affected packages

Git / github.com/1panel-dev/maxkb

Affected ranges

Type
GIT
Repo
https://github.com/1panel-dev/maxkb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
44b1387635918196dca7257c5291d63950c1e7e3

Affected versions

v0.*
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.10.0-lts
v1.10.1-lts
v1.10.2-lts
v1.10.3-lts
v1.10.4-lts
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v2.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66419.json"