PT-2026-32577 · Maxkb · Maxkb

Shaohuzhang1 · Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-39423

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.0

Description An Eval Injection issue exists in the Markdown rendering engine. This allows any user who can interact with the AI chat interface to execute arbitrary JavaScript in the browsers of other users, including administrators, leading to Stored Cross-Site Scripting (XSS), which is a method of injecting malicious scripts into a trusted website.

Recommendations Update to version 2.8.0.

Fix

Eval Injection

XSS

Weakness Enumeration

CWE-95

CWE-79

Related Identifiers

CVE-2026-39423

Affected Products

Maxkb

References · 6

• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-462x-99gf-mp79 · Vendor Advisory
• https://github.com/1Panel-dev/MaxKB/commit/34fb95bde9574c5b3a734ab00c7f29b9e7d32669 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39423 · Security Note
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Note
• https://twitter.com/CVEarity/status/2044098319560126547 · Twitter Post
• https://twitter.com/CVEnew/status/2043976150616060051 · Twitter Post