github.com
https://github.com/1Panel-dev/MaxKB/commit/026a2d623e2aa5efa67c4834651e79d5d7cab1da CVE-2026-39422
MEDIUM
MaxKB has Stored XSS via ChatHeadersMiddleware
Record summary
CVE-2026-39422 has a selected CVSS score of 6.9 (medium).
Description
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability through the application name or icon fields when creating an application. When a victim visits the public chat interface (/ui/chat/{access_token}), the ChatHeadersMiddleware retrieves the application data and directly inserts the unescaped application name and icon into the HTML response via string replacement. This allows an attacker to execute arbitrary JavaScript in the victim's browser context. This issue has been fixed in version 2.8.0.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 14, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 2.8.0 | affected |
References
3github.com
https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 github.comConfirmation
https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-wf7p-3jq5-q52w