CVE-2026-39425

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability that allows authenticated users to inject arbitrary HTML and JavaScript into the Application prologue (Opening Remarks) field by wrapping malicious payloads in <html_rander> tags. The backend fails to sanitize or encode HTML entities in the prologue field when applications are created or updated via the /admin/api/workspace/{workspace_id}/application endpoint, storing the raw payload directly in the database. The frontend then renders this content using an innerHTML-equivalent mechanism, trusting <html_rander>-wrapped content to be safe, which enables persistent DOM-based Stored XSS execution against any visitor who opens the affected chatbot interface. Exploitation can lead to session hijacking, unauthorized actions performed on behalf of victims (such as deleting workspaces or applications), and sensitive data exposure. This issue has been fixed in version 2.8.0.

• CWE-80

• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0Release Notes
• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-3rq5-pgm7-pvp4Vendor Advisory

Published

Apr 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3942Incorrect security UI in PictureInPicture in Google Chrome p…4.3
• CVE-2026-39420MaxKB is an open-source AI assistant for enterprise. In vers…7.4
• CVE-2026-39421MaxKB is an open-source AI assistant for enterprise. Version…7.4
• CVE-2026-39422MaxKB is an open-source AI assistant for enterprise. Version…5.4
• CVE-2026-39423MaxKB is an open-source AI assistant for enterprise. Version…5.4
• CVE-2026-39424MaxKB is an open-source AI assistant for enterprise. In vers…4.7
• CVE-2026-39426MaxKB is an open-source AI assistant for enterprise. Version…5.4
• CVE-2026-39428CubeCart is an ecommerce software solution. Prior to 6.6.0, …4.8
• CVE-2026-39429kcp is a Kubernetes-like control plane for form-factors and …9.1
• CVE-2026-3943A vulnerability was found in H3C ACG1000-AK230 up to 2026022…7.3
• CVE-2026-39432Missing Authorization vulnerability in Arraytics Timetics al…8.2
• CVE-2026-39433Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 vers…6.5