CVE Feed

    Dashboard / CVE / CVE-2025-53928

    CVE-2025-53928

    MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. Versions 1.10.9-lts and 2.0.0 fix the issue.

    Published:Jul 17, 2025
    Last Modified:Aug 2, 2025
    EPS:Jul 17, 2025
    EPSS Score:0.00476
    CVSS Score:4.6

    Affected Products

    Vendor
    Maxkb
    Product
    Maxkb

    Exploits

    https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-38q2-4mm7-qf5h

    Related CVEs

    CVE-2026-56779 (CVSS 5.3) — MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints…
    CVE-2026-39426 (CVSS 5.1) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39425 (CVSS 5.1) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39419 (CVSS 3.1) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can by…
    CVE-2026-39424 (CVSS 5.3) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is v…
    CVE-2026-39423 (CVSS 6.9) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulner…
    CVE-2026-39422 (CVSS 6.9) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scri…
    CVE-2026-39421 (CVSS 6.3) — MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnera…
    CVE-2026-39420 (CVSS 6.3) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protec…
    CVE-2026-39418 (CVSS 5) — MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection c…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High