CVE-2025-60455 is an unsafe deserialization vulnerability in Modular Max Serve versions prior to 25.6. This flaw occurs when the "--experimental-enable-kvcache-agent" feature is enabled, allowing attackers to execute arbitrary code remotely without authentication. The vulnerability has a critical severity with a CVSS 4.0 score of 9.3. A fixed version, 25.6.0, has been released to address this issue.