Is there a patch available for CVE-2026-39422?

Yes, a patch is available for CVE-2026-39422. Update the affected software to the latest version immediately.

Maxkb CVE-2026-39422

Q: What is the CVSS score of CVE-2026-39422?

CVE-2026-39422 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22182 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 GitHub_M

XSS Maxkb 1Panel Dev

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 20, 2026 - 17:34 nvd

Patch available

Apr 16, 2026 - 05:29 EUVD

2.8.0

Analysis Generated

Apr 14, 2026 - 01:22 vuln.today

CVSS changed

Apr 14, 2026 - 01:22 NVD

6.9 (MEDIUM)

EUVD ID Assigned

Apr 14, 2026 - 01:15 euvd

EUVD-2026-22182

Analysis Generated

Apr 14, 2026 - 01:15 vuln.today

CVE Published

Apr 14, 2026 - 00:22 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability through the application name or icon fields when creating an application. When a victim visits the public chat interface (/ui/chat/{access_token}), the ChatHeadersMiddleware retrieves the application data and directly inserts the unescaped application name and icon into the HTML response via string replacement. This allows an attacker to execute arbitrary JavaScript in the victim's browser context. This issue has been fixed in version 2.8.0.

AnalysisAI

Stored Cross-Site Scripting (XSS) in MaxKB 2.7.1 and below allows authenticated users to inject malicious JavaScript through application name or icon fields, which is then executed in victims' browsers when accessing the public chat interface. The vulnerability stems from unsanitized data insertion into HTML responses by ChatHeadersMiddleware, enabling arbitrary code execution with user interaction. MaxKB 2.8.0 has released a patch to fix this issue.

Technical ContextAI

MaxKB is an open-source AI assistant framework that manages applications with public chat interfaces. The vulnerability exists in the ChatHeadersMiddleware component, which retrieves application metadata (name and icon fields) from storage and directly inserts them into HTML responses via string replacement without HTML escaping or sanitization. This represents a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue where user-controlled input from application configuration is rendered as HTML without proper encoding. The attack surface includes the /ui/chat/{access_token} endpoint, a publicly accessible endpoint that dynamically loads application data. An authenticated attacker with application creation privileges can craft payloads containing JavaScript code (e.g., <script> tags, event handlers) in the application name or icon field; when any victim visits the chat interface, their browser executes this injected script in the context of the application domain.

RemediationAI

Vendor-released patch: MaxKB 2.8.0. Upgrade immediately to version 2.8.0 or later from https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0. For organizations unable to upgrade immediately, implement HTML escaping or Content Security Policy (CSP) headers to mitigate stored XSS risk, though these are temporary measures and patching is mandatory. Audit existing MaxKB instances for applications with suspicious names or icon URLs created by untrusted users and remove or sanitize them. Refer to the vendor security advisory at https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-wf7p-3jq5-q52w for detailed mitigation guidance.