Modular Max Serve has Unsafe Deserialization vulnerability

HOCH 8.4CVE-2025-60455 · GHSA-7xcv-9j6c-2fmc · PYSEC-2025-253 · Published 18/11/2025 · updated 05/11/2026

Kurz gesagt

CVE-2025-60455 ist eine Schwachstelle (HOCH (CVSS 8.4)) in max, modular, max (modular).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.33%, höher als bei 26.6% aller Schwachstellen.
Abhilfe: auf 25.6.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
max PyPI	`< 25.6.0`	`25.6.0`
modular PyPI	`< 25.6.0`	`25.6.0`
max modular	`< 25.6.0`	`25.6.0`

Description

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

NVD description

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

References

nvd.nist.gov/vuln/detail/CVE-2025-60455 · ADVISORY
modular/modular · WEB
modular/modular commit 1062005 · WEB
modular/modular commit b20e749 · WEB
modular/modular commit ee9c4ab · WEB
modular/modular · PACKAGE
modular/modular · WEB
oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem · WEB
pypi.org/project/modular · PACKAGE
GitHub Advisory GHSA-7xcv-9j6c-2fmc · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free