CVE-2026-45413 affects MaxKB versions prior to 2.9.1, where user passwords are stored using unsalted MD5 hashes. This weak hashing method makes password hashes trivially crackable using rainbow tables or GPU-accelerated brute force tools. The vulnerability is fixed in version 2.9.1. The CVSS 4.0 score is 6.9, indicating a medium severity risk primarily due to local attack vector and no required privileges or user interaction.
MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch (chat/api/oss/get_url) endpoint. The vulnerability exists due to inconsistent URL parsing between the urlparse validation function and the requests HTTP client, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1.
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability where the frontend's MdRenderer.vue component parses custom <iframe_render> tags from LLM responses or Application Prologue configurations, bypassing standard Markdown sanitization and XSS filtering. The unsanitized HTML content is passed to the IframeRender.vue component, which renders it directly into an <iframe> via the srcdoc attribute configured with sandbox="allow-scripts allow-same-origin". This can be a dangerous combination, allowing injected scripts to escape the iframe and execute JavaScript in the parent window using window.parent. Since the Prologue is rendered for any user visiting an application's chat interface, this results in a high-impact Stored XSS that can lead to session hijacking, unauthorized actions, and sensitive data exposure. This issue has been fixed in version 2.8.0.
MaxKB versions 2.7.1 and below contain a stored cross-site scripting (XSS) vulnerability in the Application prologue field. Authenticated users can inject arbitrary HTML and JavaScript by using <html_rander> tags, which the backend does not sanitize before storing. The frontend renders this content unsafely, enabling persistent XSS that affects any visitor opening the chatbot interface. Exploitation may lead to session hijacking, unauthorized actions, and data exposure. This vulnerability is fixed in version 2.8.0.
CVE-2026-39419 is a vulnerability in MaxKB versions 2.7.1 and below that allows an authenticated user to bypass sandbox result validation and spoof tool execution results. The attacker exploits Python frame introspection to read a UUID from bytecode constants and writes a forged result directly to file descriptor 1, bypassing stdout redirection. By calling sys.exit(0), the attacker terminates the wrapper before legitimate output is printed, causing the service to trust the spoofed response. This issue is fixed in version 2.8.0.
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable to Improper Neutralization of Formula Elements in a CSV File. When an administrator exports the application chat history to an Excel file (.xlsx) via the /admin/api/workspace/{workspace_id}/application/{application_id}/chat/export endpoint, strings starting with formula characters are written directly without proper sanitization. Opening this file in spreadsheet applications like Microsoft Excel can lead to Arbitrary Code Execution (RCE) on the administrator's workstation via Dynamic Data Exchange (DDE). The issue is a variant of CVE-2025-4546, which fixed the exact same pattern in apps/dataset/serializers/document_serializers.py but missed the application chat export sink. This issue has been fixed in version 2.8.0.
CVE-2026-39423 is a stored cross-site scripting (XSS) vulnerability in MaxKB versions 2.7.1 and below. It arises from an Eval Injection flaw in the Markdown rendering engine, allowing users interacting with the AI chat interface to execute arbitrary JavaScript in other users' browsers, including administrators. This vulnerability has been fixed in version 2.8.0. The CVSS 4.0 base score is 6.9, indicating medium severity.
MaxKB versions 2.7.1 and below contain a stored Cross-Site Scripting (XSS) vulnerability in the application name and icon fields. This vulnerability allows an attacker to inject arbitrary JavaScript that executes when a user visits the public chat interface. The issue arises because the application inserts unescaped user input directly into the HTML response. This vulnerability has been fixed in version 2.8.0. The CVSS 4.0 score is 6.
MaxKB versions 2.7.1 and below have a sandbox escape vulnerability in the ToolExecutor component. An authenticated user with workspace privileges can bypass the LD_PRELOAD-based sandbox by exploiting Python's ctypes to make direct kernel system calls. This allows arbitrary code execution, potentially leading to network exfiltration and container compromise. The vulnerability arises because the sandbox blocks mprotect but not pkey_mprotect, enabling executable memory allocation bypass. This issue is fixed in version 2.8.0.
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mechanism allows an authenticated user with tool execution privileges to escape the LD_PRELOAD-based sandbox. By env command the attacker can clear the environment variables and drop the sandbox.so hook, leading to unrestricted Remote Code Execution (RCE) and network access. MaxKB restricts untrusted Python code execution via the Tool Debug API by injecting sandbox.so through the LD_PRELOAD environment variable. This intercepts sensitive C library functions (like execve, socket, open) to restrict network and file access. However, a patch allowed the /usr/bin/env utility to be executed by the sandboxed user. When an attacker is permitted to create subprocesses, they can execute the env -i python command. The -i flag instructs env to completely clear all environment variables before running the target program. This effectively drops the LD_PRELOAD environment variable. The newly spawned Python process will therefore execute natively without any sandbox hooks, bypassing all network and file system restrictions. This issue has been fixed in version 2.8.0.
CVE-2026-39418 is a Server-Side Request Forgery (SSRF) vulnerability in MaxKB versions 2.7.1 and below. The issue arises because the sandbox network protection can be bypassed using the socket.sendto() function with the MSG_FASTOPEN flag, allowing authenticated users with tool-editing permissions to access internal services blocked by the sandbox. This bypass occurs because the sandbox hooks the connect() function to block banned IPs, but sendto() with MSG_FASTOPEN establishes TCP connections without calling connect(), circumventing IP validation. The vulnerability has been fixed in MaxKB version 2.8.0. The CVSS score is 5.
CVE-2026-39417 is an OS command injection vulnerability in 1Panel-dev MaxKB versions 2.7.1 and below. It arises from an incomplete fix for a previous vulnerability (CVE-2025-53928) where the MCP node configuration can still be injected via user-supplied JSON in the workflow creation API. This allows an attacker with limited privileges to inject arbitrary commands that execute when the workflow is triggered. The issue is fixed in version 2.8.0. The CVSS score is 4.6, indicating medium severity.
A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component MdPreview. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.5.0 is recommended to address this issue. The name of the patch is 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability was found in 1Panel-dev MaxKB up to 2.6.1. The affected element is the function execute of the file apps/application/flow/step_node/mcp_node/impl/base_mcp_node.py of the component Model Context Protocol Node. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A flaw has been found in 1Panel-dev MaxKB up to 2.6.1. This issue affects some unknown processing of the file apps/common/middleware/chat_headers_middleware.py of the component ChatHeadersMiddleware. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the attack is possible. Upgrading to version 2.8.0 is capable of addressing this issue. Patch name: 026a2d623e2aa5efa67c4834651e79d5d7cab1da. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. This vulnerability affects the function StaticHeadersMiddleware of the file apps/common/middleware/static_headers_middleware.py of the component Public Chat Interface. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 2.8.0 is able to resolve this issue. The patch is identified as 026a2d623e2aa5efa67c4834651e79d5d7cab1da. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user’s browser, potentially compromising session data or sensitive system interfaces. All versions of 1Panel up to and including v1.10.33-lts and v2.0.16 are affected. An attacker could publish a malicious application that, when loaded by users (locally or remotely), can execute arbitrary scripts. This may result in theft of user cookies, unauthorized access to system functions, or other actions that compromise the confidentiality, integrity, and availability of the system. The vulnerability is caused by insufficient sanitization of content rendered by the MdEditor component with the `previewOnly` attribute enabled. Specifically, the App Store renders application README content without proper XSS protection, allowing script execution during content rendering; and similar issues exist in system upgrade-related components, which can be fixed by implementing proper XSS sanitization in the MdEditor component. These vulnerabilities can be mitigated by applying proper XSS protection and sanitization when rendering content in the MdEditor component. Safe versions with a patch incorporated are v1.10.34-lts and v2.0.17.
MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0.
MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For: 127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.