Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable to Improper Neutralization of Formula Elements in a CSV File. When an administrator exports the application chat history to an Excel file (.xlsx) via the /admin/api/workspace/{workspace_id}/application/{application_id}/chat/export endpoint, strings starting with formula characters are written directly without proper sanitization. Opening this file in spreadsheet applications like Microsoft Excel can lead to Arbitrary Code Execution (RCE) on the administrator's workstation via Dynamic Data Exchange (DDE). The issue is a variant of CVE-2025-4546, which fixed the exact same pattern in apps/dataset/serializers/document_serializers.py but missed the application chat export sink. This issue has been fixed in version 2.8.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚡ New CVE Alert: CVE-2026-39424 📊 Severity: 5.3 🚨 Risk Level: Medium 🧩 Affects: Microsoft Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-39424 #CVE-2026-39424 #CVE #Medium #Microsoft #CyberSecurity #InfoSec https://t.co/LkUuytjXWR
Post summary
The tweet announces the existence of CVE‑2026‑39424, provides its severity rating, and links to the NVD entry, but offers no technical, exploit, or patch information.
Kurumsal AI asistanlarında güvenlik açıkları görmek beni düşündürüyor. MaxKB'nin yeni keşfedilen CVE-2026-39424 kodlu açığı, açık kaynaklı araçların ne kadar savunmasız olabileceğini kanıtlıyor. Güvenlik önlemlerine daha fazla önem vermek zorundayız. Bence, AI tabanlı sistemlerin siber güvenlik risklerini iyileştirmek hepimizin sorumluluğunda! üvenlik
Post summary
The text announces the discovery of a new CVE-2026-39424 in MaxKB AI assistants, emphasizing the need for enhanced security.
CVE-2026-39424 MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable to Improper Neutralization of Formula Elements… https://www.cve.org/CVERecord?id=CVE-2026-39424
Post summary
CVE-2026-39424 highlights a flaw in MaxKB’s chat export feature related to improper neutralization of formula elements, with no PoC, exploit, active exploitation, or patch details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | maxkb | maxkb | - | - | - |