Medium severity5.4NVD Advisory· Published Apr 14, 2026· Updated Apr 20, 2026
CVE-2026-39422
CVE-2026-39422
Description
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability through the application name or icon fields when creating an application. When a victim visits the public chat interface (/ui/chat/{access_token}), the ChatHeadersMiddleware retrieves the application data and directly inserts the unescaped application name and icon into the HTML response via string replacement. This allows an attacker to execute arbitrary JavaScript in the victim's browser context. This issue has been fixed in version 2.8.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:maxkb:maxkb:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:maxkb:maxkb:*:*:*:*:-:*:*:*range: <2.8.0
- (no CPE)range: <=2.7.1
Patches
Vulnerability mechanics
References
3- github.com/1Panel-dev/MaxKB/commit/026a2d623e2aa5efa67c4834651e79d5d7cab1danvdPatch
- github.com/1Panel-dev/MaxKB/security/advisories/GHSA-wf7p-3jq5-q52wnvdExploitVendor Advisory
- github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0nvdRelease Notes
News mentions
0No linked articles in our index yet.