Skip to content

Instantly share code, notes, and snippets.

@avilum

avilum/modular-CVE-2025-60455-info

Created November 18, 2025 16:46
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save avilum/55eee81d1bdddf2f2cccd8680cf3fbda to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save avilum/55eee81d1bdddf2f2cccd8680cf3fbda to your computer and use it in GitHub Desktop.
Download ZIP
Modular Max CVE-2025-60455 - RCE in Max Server when using kvcache agent
Raw
modular-CVE-2025-60455-info
The kvcache_agent component in Modular Max Server uses unauthenticated PyZMQ TCP sockets together pickle for deserialization,
which allows remote attackers to execute arbitary code with the priviliges of the modular server.
As the KV Cache Agent is currently in development and experimental, this code has being temporarily replaced with MsgPack for deserialization.
# References:
# https://github.com/simveit/modular/blob/5deed08225bb167eb5da5fb92a3f3bc62da6101a/max/serve/queue/zmq_queue.py#L49
# https://github.com/modular/modular/commit/10620059fb5c47fb0c30e5d21a8ff3b8d622fba4#diff-0a431c9c2c12d683e9d99376724b7f0325cdfdadc181649f7a9c620e54d54d91R23-R223
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment