简体中文

CVE-2026-39426：详情

CVE-2026-39426

5.4
/
中危
0.01%V4
2026-04-14
02h16 +00:00
Cross-site Scripting
A03-Injection
Network
2026-10-26
21h10 +00:00
CVE.org
NVD
指定 CVE 通知
随时了解指定 CVE 的变更。
管理通知

CVE 描述

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability where the frontend's MdRenderer.vue component parses custom tags from LLM responses or Application Prologue configurations, bypassing standard Markdown sanitization and XSS filtering. The unsanitized HTML content is passed to the IframeRender.vue component, which renders it directly into an