CVE-2026-39425: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in 1Panel-dev MaxKB
MaxKB versions 2. 7. 1 and below contain a stored cross-site scripting (XSS) vulnerability in the Application prologue field. Authenticated users can inject arbitrary HTML and JavaScript by using <html_rander> tags, which the backend does not sanitize before storing. The frontend renders this content unsafely, enabling persistent XSS that affects any visitor opening the chatbot interface. Exploitation may lead to session hijacking, unauthorized actions, and data exposure. This vulnerability is fixed in version 2. 8. 0.
AI Analysis
Technical Summary
CVE-2026-39425 is a stored XSS vulnerability in MaxKB (versions ≤ 2.7.1) where the Application prologue field accepts malicious payloads wrapped in <html_rander> tags without proper sanitization or encoding. The backend stores raw HTML/JavaScript in the database, and the frontend renders it using an innerHTML-equivalent method, trusting the content to be safe. This allows persistent DOM-based XSS attacks against any user viewing the affected chatbot interface. The vulnerability requires authenticated access to inject payloads but can impact any visitor. The issue is resolved in MaxKB version 2.8.0.
Potential Impact
Successful exploitation allows attackers to execute arbitrary scripts in the context of users visiting the chatbot interface, potentially leading to session hijacking, unauthorized actions such as deleting workspaces or applications, and exposure of sensitive data. The vulnerability affects authenticated users who can inject payloads and any user who views the malicious content.
Mitigation Recommendations
Upgrade MaxKB to version 2.8.0 or later, where this vulnerability has been fixed. Since the vendor advisory confirms the fix in 2.8.0, applying this official update fully mitigates the issue.
CVE-2026-39425: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in 1Panel-dev MaxKB
Description
MaxKB versions 2. 7. 1 and below contain a stored cross-site scripting (XSS) vulnerability in the Application prologue field. Authenticated users can inject arbitrary HTML and JavaScript by using <html_rander> tags, which the backend does not sanitize before storing. The frontend renders this content unsafely, enabling persistent XSS that affects any visitor opening the chatbot interface. Exploitation may lead to session hijacking, unauthorized actions, and data exposure. This vulnerability is fixed in version 2. 8. 0.
CVSS v4.0
Score 5.1medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-39425 is a stored XSS vulnerability in MaxKB (versions ≤ 2.7.1) where the Application prologue field accepts malicious payloads wrapped in <html_rander> tags without proper sanitization or encoding. The backend stores raw HTML/JavaScript in the database, and the frontend renders it using an innerHTML-equivalent method, trusting the content to be safe. This allows persistent DOM-based XSS attacks against any user viewing the affected chatbot interface. The vulnerability requires authenticated access to inject payloads but can impact any visitor. The issue is resolved in MaxKB version 2.8.0.
Potential Impact
Successful exploitation allows attackers to execute arbitrary scripts in the context of users visiting the chatbot interface, potentially leading to session hijacking, unauthorized actions such as deleting workspaces or applications, and exposure of sensitive data. The vulnerability affects authenticated users who can inject payloads and any user who views the malicious content.
Mitigation Recommendations
Upgrade MaxKB to version 2.8.0 or later, where this vulnerability has been fixed. Since the vendor advisory confirms the fix in 2.8.0, applying this official update fully mitigates the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-07T00:23:30.596Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69dd9c8b82d89c981fa11928
Added to database: 4/14/2026, 1:46:51 AM
Last enriched: 4/21/2026, 6:18:22 AM
Last updated: 5/29/2026, 10:12:11 PM
Views: 91
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.