CVE-2025-64703

MEDIUM

maxkb < 2.3.1 - Exposure of Sensitive Information via Tool Module Python Code

Title source: llm

Description

MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-qwvm-x4xh-g2qq

Scores

CVSS v3 6.3

EPSS 0.0017

EPSS Percentile 6.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (1)

maxkb/maxkb < 2.3.1

Published Nov 13, 2025

Tracked Since Feb 18, 2026