EUVD-2026-22184Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulnerability in the Markdown rendering engine that allows any user capable of interacting with the AI chat interface to execute arbitrary JavaScript in the browsers of other users, including administrators, resulting in Stored Cross-Site Scripting (XSS). This issue has been fixed in version 2.8.0.
AnalysisAI
Stored Cross-Site Scripting (XSS) via Eval Injection in MaxKB's Markdown rendering engine allows authenticated users to execute arbitrary JavaScript in other users' browsers, including administrators. MaxKB versions 2.7.1 and below are affected. The vulnerability requires user interaction (UI:P) and low privileges (PR:L) to exploit, but delivers high integrity impact (VI:H) to victim sessions. A vendor-released patch is available in version 2.8.0.
Technical ContextAI
MaxKB is an open-source AI assistant platform that processes Markdown content rendered in user browsers. The vulnerability resides in the Markdown rendering engine's Eval Injection flaw (CWE-79, Improper Neutralization of Input During Web Page Generation), where untrusted user-supplied Markdown is evaluated as code rather than safely sanitized. This allows injection of malicious JavaScript payloads through chat messages that execute in the browser context of any user viewing the rendered content, including privileged administrators. The attack leverages the Markdown parser's unsafe handling of certain constructs that are interpreted as executable code rather than display-safe markup.
RemediationAI
Vendor-released patch: upgrade MaxKB to version 2.8.0 or later. This release contains fixes to the Markdown rendering engine that properly sanitize user input to prevent eval injection. Administrators should prioritize this upgrade, particularly for instances exposed to untrusted users or in multi-tenant environments. The patched version is available at https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0. No workarounds are documented; patching is the recommended remediation. Verify the upgrade by confirming the version reported in the MaxKB UI matches 2.8.0 or higher.
MaxKB prior to version 1.10.8-lts contains an incomplete sandbox implementation that only blacklists binary execution in
Server-side request forgery in MaxKB before 2.10.0 allows any authenticated user holding the default workspace USER role
OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated
Authentication bypass in MaxKB (1Panel-dev) versions prior to 2.9.0 allows remote unauthenticated attackers to invoke we
Stored Cross-Site Scripting (XSS) in MaxKB 2.7.1 and below allows authenticated users to inject malicious JavaScript thr
MaxKB, an open-source enterprise AI assistant by 1Panel-dev, stores user passwords as unsalted MD5 hashes, exposing all
MaxKB versions 2.7.1 and below allow authenticated users with tool execution privileges to bypass the LD_PRELOAD-based s
MaxKB versions 2.7.1 and below allow authenticated attackers with workspace privileges to execute arbitrary code by expl
Server-side request forgery in MaxKB v2.8.0 and earlier allows authenticated low-privilege users to reach internal netwo
Server-Side Request Forgery in MaxKB before 2.9.1 allows authenticated users to pivot into internal network infrastructu
OS command injection in 1Panel-dev MaxKB up to version 2.6.1 allows authenticated remote attackers to execute arbitrary
Cross-site scripting (XSS) in 1Panel-dev MaxKB up to version 2.4.2 allows authenticated remote attackers to inject malic
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today