Dashboard / CVE-2026-39423

CVE-2026-39423

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 54/100
Published: 2026-04-14 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Passive
S: X
AT: None
VC: None
VI: High
VA: None

Description

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulnerability in the Markdown rendering engine that allows any user capable of interacting with the AI chat interface to execute arbitrary JavaScript in the browsers of other users, including administrators, resulting in Stored Cross-Site Scripting (XSS). This issue has been fixed in version 2.8.0.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
maxkb maxkb < 2.8.0

References & Advisories (3)

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.17%
Raw Score 0.001730
Percentile 6.7%
Date 2026-10-28

Intelligence Sources

nvd ref →

External Links