Stored Cross-Site Scripting Vulnerability in MaxKB AI Assistant by 1Panel

CVE-2026-39426

What is CVE-2026-39426?

MaxKB, an open-source AI assistant developed by 1Panel, has a security vulnerability that allows attackers to execute malicious scripts through the application's chat interface. This Stored Cross-Site Scripting (XSS) issue arises when the MdRenderer.vue component improperly processes custom <iframe_render> tags, bypassing the required Markdown sanitization. Consequently, unsanitized HTML content is rendered directly in an , enabling injected scripts to escape and execute JavaScript in the parent context. This vulnerability can lead to serious consequences, including session hijacking, unauthorized actions, and sensitive data exposure for any user who interacts with the compromised interface. The vulnerability has been addressed in version 2.8.0.

References