PT-2026-32585 · Maxkb · Maxkb

Liqiang · Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-39426

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.0

Description A Stored Cross-Site Scripting (XSS) issue exists where the frontend MdRenderer.vue component parses custom <iframe render> tags from LLM responses or Application Prologue configurations. This process bypasses standard Markdown sanitization and XSS filtering. The unsanitized HTML content is then passed to the IframeRender.vue component, which renders it directly into an <iframe> via the srcdoc attribute configured with sandbox="allow-scripts allow-same-origin". This allows injected scripts to escape the iframe and execute JavaScript in the parent window using window.parent. Because the Prologue is rendered for any user visiting an application chat interface, this can lead to session hijacking, unauthorized actions, and sensitive data exposure.

Recommendations Update to version 2.8.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39426

Affected Products

Maxkb

References · 6

• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-q2qg-43vq-f2wv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39426 · Security Note
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Note
• https://twitter.com/CVEarity/status/2044112253495185619 · Twitter Post
• https://twitter.com/CVEnew/status/2043976144668492048 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043972788780667154 · Twitter Post