CVSS 3.1
8.4 highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2025-60455
High (8.4) in modular max. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in modular 25.6.0.
Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- modular:max
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7xcv-9j6c-2fmc | PyPI | modular | <25.6.0 | 25.6.0 |
| PYSEC-2025-253 | PyPI | max | <25.6.0 | 25.6.0 |
| PYSEC-2026-427 | PyPI | modular | <25.6.0 | 25.6.0 |
References
- https://github.com/modular/modular/blame/main/max/serve/kvcache_agent/kvcache_agent.py#L220
- https://github.com/modular/modular/commit/10620059fb5c47fb0c30e5d21a8ff3b8d622fba4
- https://github.com/modular/modular/commit/b20e749fa892dbe772e890a268002f732164d9f5
- https://github.com/modular/modular/commit/ee9c4ab02345dd30bed8b79771b6909ff1b930a1
- https://github.com/modular/modular/issues/4795