VulnSocial

CVE-2026-39423Disclosure(maxkb / maxkb)

LOWCVSS 5.4 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulnerability in the Markdown rendering engine that allows any user capable of interacting with the AI chat interface to execute arbitrary JavaScript in the browsers of other users, including administrators, resulting in Stored Cross-Site Scripting (XSS). This issue has been fixed in version 2.8.0.

maxkb CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-79CWE-95

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • maxkb

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
maxkb
Products
maxkb

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-14: 2Technical Details · 2026-04-14: 104-14
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVEarity@CVEarity
    General

    ⚡ New CVE Alert: CVE-2026-39423 📊 Severity: 6.9 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-39423 #CVE-2026-39423 #CVE #Medium #CyberSecurity #InfoSec https://t.co/Pbp41MQ5gS

    Post summary

    The tweet announces a new CVE‑2026‑39423 with a medium severity score of 6.9, indicating multiple unspecified products are affected, but provides no further technical details, exploit code, or patch information.

    0000026
    137 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-39423 MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulnerability in the Markdown rendering engine that allows any… https://www.cve.org/CVERecord?id=CVE-2026-39423

    Post summary

    A brief disclosure notes an Eval Injection vulnerability in MaxKB's Markdown rendering engine (versions 2.7.1 and below), but no PoC, exploit details, patch, or evidence of active exploitation is presented.

    0000062
    57.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmaxkbmaxkb---

Explore more

Back to dashboardmaxkb CVEsmaxkb vulnerabilities