CVE-2026-39426 is a stored XSS vulnerability in MaxKB (versions < 2.8.0) where the MdRenderer.vue component parses custom <iframe_render> tags from LLM responses or Application Prologue configurations without proper sanitization. The unsanitized HTML is passed to IframeRender.vue, which renders it inside an iframe using the srcdoc attribute with sandbox="allow-scripts allow-same-origin". This sandbox configuration allows injected scripts to escape the iframe sandbox and execute JavaScript in the parent window via window.parent. Since the Prologue is rendered for all users visiting the chat interface, this vulnerability can lead to session hijacking, unauthorized actions, and sensitive data exposure.

The vulnerability enables attackers to inject malicious scripts that execute in the context of the parent window for any user accessing the affected chat interface. This can result in session hijacking, unauthorized actions on behalf of the user, and exposure of sensitive information. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, and partial impact on confidentiality, integrity, and availability.

This vulnerability is fixed in MaxKB version 2.8.0. Users and administrators should upgrade to version 2.8.0 or later to remediate this issue. No additional vendor advisory or patch links are provided, but the version upgrade is the official fix.