PT-2026-32577 · 1Panel Dev · Maxkb

Shaohuzhang1 · Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-39423

NVD

CVSS v4.0

6.9

Medium

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulnerability in the Markdown rendering engine that allows any user capable of interacting with the AI chat interface to execute arbitrary JavaScript in the browsers of other users, including administrators, resulting in Stored Cross-Site Scripting (XSS). This issue has been fixed in version 2.8.0.

Fix

Eval Injection

XSS

Weakness Enumeration

CWE-95

CWE-79

Related Identifiers

CVE-2026-39423

Affected Products

Maxkb

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-39423 · Security Note
• https://github.com/1Panel-dev/MaxKB/commit/34fb95bde9574c5b3a734ab00c7f29b9e7d32669 · Note
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-462x-99gf-mp79 · Note
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Note
• https://twitter.com/CVEarity/status/2044098319560126547 · Twitter Post
• https://twitter.com/CVEnew/status/2043976150616060051 · Twitter Post