CVE-2024-56137 MaxKB RCE vulnerability in function library
Privileged users can execute arbitrary OS commands via custom scripts in the function library module of MaxKB.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-56137?
CVE-2024-56137 is a medium-severity command injection vulnerability in 1Panel-dev MaxKB, published on 2 Jan 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.
Weakness: CWE-78
Which versions are affected by CVE-2024-56137?
It affects 1 product.
Products include Maxkb Maxkb.
How do I fix CVE-2024-56137?
No fix has been published for CVE-2024-56137 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-56137 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-56137 exists.
Other vulnerabilities in 1Panel-dev MaxKB
- CVE-2025-66419 MaxKB vulnerable to privilege escalation through sandbox bypass
- CVE-2025-66446 MaxKB has a Python sandbox LD_PRELOAD bypass
- CVE-2025-64511 MaxKB has SSRF in sandbox
- CVE-2026-39422 MaxKB has Stored XSS via ChatHeadersMiddleware
- CVE-2026-39423 Stored XSS via Eval Injection in EchartsRander Component
Sources
Also known as GHSA-76w2-2g72-cg85.