p PatchFirst

CVE-2025-60455

CVE-2025-60455

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

CVSS 8.4 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • modular PyPI

    Versions
    • 25.3.0
    • 25.4.0
    • 25.5.0
    Affected ranges
    • ECOSYSTEM: < 25.6.0

    Update to 25.6.0

  • max PyPI

    Versions
    • 25.3.0
    • 25.4.0
    • 25.5.0
    Affected ranges
    • ECOSYSTEM: < 25.6.0

    Update to 25.6.0

Original sources

Check your server →