Modular Max Serve has Unsafe Deserialization vulnerability

高危 8.4CVE-2025-60455 · GHSA-7xcv-9j6c-2fmc · PYSEC-2025-253 · Published 18/11/2025 · updated 05/11/2026

要点

CVE-2025-60455 是影响 max, modular, max (modular) 的高危 (CVSS 8.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.33%，高于 26.7% 的漏洞。
修复：升级到 25.6.0 或更高版本。

Package	Affected versions	Patched versions
max PyPI	`< 25.6.0`	`25.6.0`
modular PyPI	`< 25.6.0`	`25.6.0`
max modular	`< 25.6.0`	`25.6.0`

Description

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

NVD description

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

References

nvd.nist.gov/vuln/detail/CVE-2025-60455 · ADVISORY
modular/modular · WEB
modular/modular commit 1062005 · WEB
modular/modular commit b20e749 · WEB
modular/modular commit ee9c4ab · WEB
modular/modular · PACKAGE
modular/modular · WEB
oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem · WEB
pypi.org/project/modular · PACKAGE
GitHub Advisory GHSA-7xcv-9j6c-2fmc · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free