This vulnerability in 1Panel-dev MaxKB (up to version 2.4.2) involves a cross-site scripting flaw in the MdPreview component, specifically in an unknown function within ui/src/chat.ts. The vulnerability allows remote attackers to inject malicious scripts, potentially leading to client-side code execution. The vendor responded promptly and released a fixed version 2.5.0, identified by patch 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8. The CVSS 4.0 score is 5.1, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Successful exploitation of this vulnerability could allow remote attackers to perform cross-site scripting attacks, potentially leading to the execution of malicious scripts in the context of the affected application. This may result in unauthorized actions performed on behalf of the user or theft of sensitive information accessible to the application. However, the impact is limited as indicated by the medium CVSS score and the requirement for user interaction.

Upgrade 1Panel-dev MaxKB to version 2.5.0 or later, which contains the official fix for this vulnerability. The vendor has released this patch promptly after disclosure. No additional mitigation steps are indicated by the vendor advisory.