PT-2025-47378 · Unknown · Modular Max Serve

Published 2025-11-18 · Updated 2026-04-08 · CVE-2025-60455

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Modular Max Serve versions prior to 25.6

Description An unsafe deserialization issue exists in Modular Max Serve when the "--experimental-enable-kvcache-agent" feature is utilized. This allows attackers to potentially execute arbitrary code. The issue occurs due to improper handling of deserialized data.

Recommendations Update Modular Max Serve to version 25.6 or later. Disable the "--experimental-enable-kvcache-agent" feature.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-60455

GHSA-7XCV-9J6C-2FMC

Affected Products

Modular Max Serve

References · 14

• 🔥 https://oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem · Exploit
• https://github.com/modular/modular/commit/ee9c4ab02345dd30bed8b79771b6909ff1b930a1 · Patch
• https://github.com/modular/modular/commit/10620059fb5c47fb0c30e5d21a8ff3b8d622fba4 · Patch
• https://github.com/modular/modular/commit/b20e749fa892dbe772e890a268002f732164d9f5 · Patch
• https://github.com/modular/modular/issues/4795 · Patch
• https://osv.dev/vulnerability/CVE-2025-60455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60455 · Security Note
• https://github.com/modular/modular/blame/main/max/serve/kvcache_agent/kvcache_agent.py#L220 · Note
• https://twitter.com/VulmonFeeds/status/1991025530418733420 · Twitter Post
• https://twitter.com/CVEnew/status/1991043000789614814 · Twitter Post
• https://reddit.com/r/DSTengine/comments/1sg35sf/14_aillm_vulnerability_classes_not_in_owasp_or · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p1gf2n/resumen_diario_de_vulnerabilidades_19112025 · Reddit Post
• https://t.me/CVEtracker/37663 · Telegram Post
• https://t.me/cveNotify/143256 · Telegram Post