CVE-2025-66419

Published: Dec 11, 2025Modified: Jun 17, 2026

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: NVD

Description

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.

Affected (1)

Products: Maxkb: Maxkb

Maxkb

1 product

Maxkb

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Maxkb Maxkb	Before 2.4.0

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (3)

https://github.com/1Panel-dev/MaxKB/commit/f8ada9a110c4dbef8c3c2636c78847ecd621ece7

Source: security-advisories@github.com

Patch

https://github.com/1Panel-dev/MaxKB/releases/tag/v2.4.0

Source: security-advisories@github.com

Release Notes

https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f9qm-2pxq-fx6c

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.