CVE-2026-39422
Description
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability through the application name or icon fields when creating an application. When a victim visits the public chat interface (/ui/chat/{access_token}), the ChatHeadersMiddleware retrieves the application data and directly inserts the unescaped application name and icon into the HTML response via string replacement. This allows an attacker to execute arbitrary JavaScript in the victim's browser context. This issue has been fixed in version 2.8.0.
Affected products
1Patches
1026a2d623e2aVulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- github.com/1Panel-dev/MaxKB/commit/026a2d623e2aa5efa67c4834651e79d5d7cab1danvdPatch
- github.com/1Panel-dev/MaxKB/security/advisories/GHSA-wf7p-3jq5-q52wnvdExploitVendor Advisory
- github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0nvdRelease Notes
News mentions
0No linked articles in our index yet.