CVE-2024-56137

Description

MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.

PUBLISHED Reserved 2024-12-16 | Published 2025-01-02 | Updated 2025-01-02 | Assigner GitHub_M

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

References

github.com/.../MaxKB/security/advisories/GHSA-76w2-2g72-cg85 exploit

github.com/.../MaxKB/security/advisories/GHSA-76w2-2g72-cg85

cve.org (CVE-2024-56137)

nvd.nist.gov (CVE-2024-56137)

Download JSON