ByteOS Network

NVD Vulnerability Details :

CVE-2024-56137

Analyzed

Source-security-advisories@github.com

Published At-02 Jan, 2025 | 15:15

Updated At-01 Aug, 2025 | 20:15

MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Primary	3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CPE Matches

maxkb>>maxkb>>Versions before 1.9.0(exclusive)

cpe:2.3:a:maxkb:maxkb:*:*:*:*:-:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-78	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-76w2-2g72-cg85	security-advisories@github.com	Exploit Vendor Advisory
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-76w2-2g72-cg85	134c704f-9b21-4f2e-91b3-4a467353bcc0	Exploit Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History