CVE-2024-56137

MEDIUM

maxkb < 1.9.0 - Authenticated Remote Code Execution via Custom Script Injection

Title source: llm
STIX 2.1

Description

MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.

References (1)

Core 1
Core References

Scores

CVSS v3 6.8
EPSS 0.0077
EPSS Percentile 50.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
maxkb/maxkb < 1.9.0
Published Jan 02, 2025
Tracked Since Feb 18, 2026