CVE Feed

    Dashboard / CVE / CVE-2024-56137

    CVE-2024-56137

    MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.

    Published:Jan 2, 2025
    Last Modified:Aug 1, 2025
    EPS:Jan 2, 2025
    EPSS Score:0.01032
    CVSS Score:6.8

    Affected Products

    Vendor
    Maxkb
    Product
    Maxkb

    Exploits

    https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-76w2-2g72-cg85https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-76w2-2g72-cg85

    Related CVEs

    CVE-2026-56779 (CVSS 5.3) — MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints…
    CVE-2026-39426 (CVSS 5.1) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39425 (CVSS 5.1) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39419 (CVSS 3.1) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can by…
    CVE-2026-39424 (CVSS 5.3) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is v…
    CVE-2026-39423 (CVSS 6.9) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulner…
    CVE-2026-39422 (CVSS 6.9) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39421 (CVSS 6.3) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnera…
    CVE-2026-39420 (CVSS 6.3) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protec…
    CVE-2026-39418 (CVSS 5) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection c…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High