CVE-2025-60455 json
Modular Max Serve has Unsafe Deserialization vulnerability
published 2025-11-18 11 mo ago modified 2026-11-05 4 d ago also GHSA-7xcv-9j6c-2fmc , PYSEC-2025-253 , PYSEC-2026-427 , EUVD-2025-198078
- cvss
- 8.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.
Patch / fix
- pypi modular 25.6.0
- pypi max 25.6.0
- modular max 25.6.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 11 mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- oligo.security https://www.oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | modular | <25.6.0 |
25.6.0 |
| pypi | max | <25.6.0 |
25.6.0 |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/modular/modular/commit/10620059fb5c47fb0c30e5d21a8ff3b8d622fba4
web, patch
-
github.com
/modular/modular/commit/ee9c4ab02345dd30bed8b79771b6909ff1b930a1
web, patch
-
github.com
/modular/modular/commit/b20e749fa892dbe772e890a268002f732164d9f5
web, patch
-
github.com
/modular/modular/issues/4795
web, issue-tracking, patch
-
oligo.security
/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem
web, exploit, third-party-advisory, evidence
-
github.com
/modular/modular/blame/main/max/serve/kvcache_agent/kvcache_agent.py#L220
web, broken-link
-
nvd.nist.gov
/vuln/detail/CVE-2025-60455
advisory
-
github.com
/modular/modular
package
-
pypi.org
/project/modular
package
-
github.com
/advisories/GHSA-7xcv-9j6c-2fmc
advisory
Sources
- CVE List CVE-2025-60455
- GitHub Advisory GHSA-7xcv-9j6c-2fmc
- NVD CVE-2025-60455
- OSV PYSEC-2026-427
- OSV PYSEC-2025-253
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.