Eval Injection Vulnerability in MaxKB AI Assistant by 1Panel

CVE-2026-39423

What is CVE-2026-39423?

The MaxKB AI Assistant, developed by 1Panel, is susceptible to an Eval Injection vulnerability affecting versions 2.7.1 and earlier. This flaw is located within the Markdown rendering engine, allowing users interacting with the AI chat interface to execute arbitrary JavaScript within the browsers of other users, including administrators. This results in Stored Cross-Site Scripting (XSS) and poses significant security risks. 1Panel has addressed this issue in the updated version 2.8.0, and users are advised to upgrade to mitigate potential attacks.

References