Vulnerability · Published Dec 11, 2025 · Assigned by GitHub_M
CVE-2025-66419MaxKB vulnerable to privilege escalation through sandbox bypass
High 8.8
In plain English
A high-severity race condition in MaxKB from 1Panel-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 76.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 1Panel-dev | MaxKB | < 2.4.0 |
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f9qm-2pxq-fx6c x_refsource_CONFIRM
- https://github.com/1Panel-dev/MaxKB/commit/f8ada9a110c4dbef8c3c2636c78847ecd621ece7 x_refsource_MISC
- https://github.com/1Panel-dev/MaxKB/releases/tag/v2.4.0 x_refsource_MISC