CVE-2025-53928

Description

MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. Versions 1.10.9-lts and 2.0.0 fix the issue.

Reserved 2025-07-14 | Published 2025-07-17 | Updated 2025-07-17 | Assigner GitHub_M

Problem types

CWE-94: Improper Control of Generation of Code ('Code Injection')

Product status

< 2.0.0
affected

< 1.10.9-lts
affected

References

github.com/.../MaxKB/security/advisories/GHSA-38q2-4mm7-qf5h

github.com/1Panel-dev/MaxKB/releases/tag/v2.0.0

cve.org (CVE-2025-53928)

nvd.nist.gov (CVE-2025-53928)

Download JSON