CVE-2025-66419

Katalog CVE

CVSS 10.0 · Critical EPSS 0,31%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada maxkb. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.

Rincian

Terbit di NVD

11 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f9qm-2pxq-fx6c advisory vendor
• https://github.com/1Panel-dev/MaxKB/commit/f8ada9a110c4dbef8c3c2636c78847ecd621ece7 patch
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.4.0 release notes