IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-11-18 19:15

MODIFIED

2025-11-18 19:15

EPSS (Prob. Exploit)

0.33%

Top 73.4%

DATA SOURCES:

NVD 🔗 2025-11-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-7xcv-9j6c-2fmc CRITICAL

Modular Max Serve has Unsafe Deserialization vulnerability

AFFECTED PACKAGES:

PIP / modular

< 25.6.0

Fixed in: 25.6.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

ALIASES:

GHSA-7xcv-9j6c-2fmc, PYSEC-2025-253, PYSEC-2026-427

> HISTORIQUE DES MODIFICATIONS

Première apparition

18/11/2025 19:15

Source: NVD

📊 ENRICHISSEMENT 19/01/2026 17:37

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui

Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/modular/modular/blame/main/max/serve/kvcache_agent/kvcache_ag...

https://github.com/modular/modular/commit/10620059fb5c47fb0c30e5d21a8ff3b8d622fb...

https://github.com/modular/modular/commit/b20e749fa892dbe772e890a268002f732164d9...

https://github.com/modular/modular/commit/ee9c4ab02345dd30bed8b79771b6909ff1b930...

https://github.com/modular/modular/issues/4795

https://www.oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerab...