What is the CVSS score of CVE-2024-56137?

CVE-2024-56137 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 3.1%.

Which versions of Maxkb are affected by CVE-2024-56137?

CVE-2024-56137 presents notable security risk, a OS command injection vulnerability rated CVSS 6.8. Exploitation could allow attackers to execute code or inject malicious input.

Is there a public PoC exploit available for CVE-2024-56137?

Yes, a public proof-of-concept exploit is available for CVE-2024-56137. Prioritise patching immediately. EPSS: 3.1%.

How to fix or mitigate CVE-2024-56137?

Within 7 days: Identify affected systems and apply vendor patches promptly. Validate input sanitization for user-controlled parameters.

Maxkb CVE-2024-56137

MEDIUM

OS Command Injection (CWE-78)

2025-01-02 security-advisories@github.com

Command Injection Maxkb

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:01 vuln.today

PoC Detected

Aug 01, 2025 - 20:15 vuln.today

Public exploit code

CVE Published

Jan 02, 2025 - 15:15 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.

AnalysisAI

MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0. Affected products include: Maxkb. Version information: version 1.9.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.