8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-60455

CVE-2025-60455: Modular Max Serve has Unsafe Deserialization vulnerability

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-60455

CVE-2025-60455:

8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
modular	pip	< 25.6.0	25.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of unsafe deserialization using Python's pickle module. The root cause is that data received over a network socket was being deserialized with pickle.loads without any validation or safety checks.

The analysis of the provided patches reveals two key points of vulnerability:

Direct Vulnerability in KVCacheAgent: The KVCacheAgent.__init__ method explicitly configured a ZMQ pull socket to use pickle.loads. This is the specific vulnerability mentioned in the CVE description, as it's triggered when the kvcache_agent is enabled. An attacker could connect to the ZMQ port and send a malicious pickle stream to achieve remote code execution.
Systemic Vulnerability in ZmqPullSocket: The ZmqPullSocket.__init__ method had pickle.loads as its default deserializer. This created a broader, systemic risk throughout the application. Any developer using this class for network communication who was unaware of this default would inadvertently introduce a security vulnerability. The patch that removed this default was a critical hardening measure to prevent similar vulnerabilities in other parts of the codebase.

During exploitation, a malicious payload would be received by the ZMQ socket, and the deserialize function (pickle.loads) would be called, leading to code execution. The functions identified, KVCacheAgent.__init__ and ZmqPullSocket.__init__, are the configuration points where this unsafe behavior was defined.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.