CVE-2026-39426: MaxKB AI Assistant Stored XSS Vulnerability

CVE-2026-39426 Overview

CVE-2026-39426 is a Stored Cross-Site Scripting (XSS) vulnerability in MaxKB, an open-source AI assistant for enterprise environments. The vulnerability exists in versions 2.7.1 and below where the frontend's MdRenderer.vue component parses custom <iframe_render> tags from LLM responses or Application Prologue configurations, effectively bypassing standard Markdown sanitization and XSS filtering mechanisms.

The unsanitized HTML content is passed to the IframeRender.vue component, which renders it directly into an <iframe> element via the srcdoc attribute configured with sandbox="allow-scripts allow-same-origin". This sandbox configuration creates a dangerous combination that allows injected scripts to escape the iframe and execute JavaScript in the parent window using window.parent. Since the Application Prologue is rendered for any user visiting an application's chat interface, this results in a high-impact Stored XSS vulnerability.

Critical Impact

This Stored XSS vulnerability can lead to session hijacking, unauthorized actions on behalf of authenticated users, and exposure of sensitive enterprise data through malicious script execution in the application's chat interface.

Affected Products

• MaxKB version 2.7.1 and all prior versions
• MaxKB deployments using the MdRenderer.vue component with custom iframe_render tags
• Enterprise AI assistant implementations utilizing Application Prologue configurations

Discovery Timeline

• 2026-04-14 - CVE-2026-39426 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-39426

Vulnerability Analysis

This Stored XSS vulnerability stems from insufficient input sanitization in MaxKB's frontend rendering pipeline. The application processes custom <iframe_render> tags that originate from two potential sources: LLM responses and Application Prologue configurations. These custom tags are designed to enable rich content rendering but introduce a significant security gap by bypassing the standard Markdown sanitization that would normally prevent XSS attacks.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents a fundamental failure to sanitize user-controllable input before it is rendered in a web context. The network-based attack vector means that any authenticated user with the ability to configure Application Prologues or influence LLM responses can inject malicious payloads that persist and execute for all visitors.

Root Cause

The root cause lies in the combination of two design decisions in the IframeRender.vue component. First, the component renders untrusted HTML content directly into an iframe using the srcdoc attribute without proper sanitization. Second, the sandbox attribute is configured with sandbox="allow-scripts allow-same-origin", which is a particularly dangerous combination.

While the sandbox attribute is intended to restrict iframe behavior, the simultaneous allowance of both allow-scripts and allow-same-origin effectively nullifies the sandbox's security benefits. This configuration allows scripts within the iframe to access the parent window's DOM through window.parent, enabling complete escape from the sandboxed context and arbitrary JavaScript execution in the main application context.

Attack Vector

The attack can be executed through two primary vectors. In the first scenario, an attacker with administrative access configures a malicious Application Prologue containing an <iframe_render> tag with embedded JavaScript. This payload then executes for every user who visits the chat interface. In the second scenario, if the LLM can be manipulated to include malicious <iframe_render> tags in its responses (through prompt injection or compromised model behavior), the XSS payload will execute when users view those responses.

Once the malicious script executes, it can leverage window.parent to access the parent window context, steal session tokens, perform unauthorized API calls, exfiltrate sensitive data displayed in the interface, or redirect users to phishing pages.

Detection Methods for CVE-2026-39426

Indicators of Compromise

• Presence of <iframe_render> tags in Application Prologue configurations containing script elements or event handlers
• LLM responses containing unexpected <iframe_render> tags with embedded JavaScript
• Unusual JavaScript execution patterns originating from iframe elements within the chat interface
• Unexpected outbound network requests from the MaxKB application to unknown domains

Detection Strategies

• Review Application Prologue configurations for any <iframe_render> tags containing <script> elements, javascript: URIs, or inline event handlers
• Implement Content Security Policy (CSP) monitoring to detect violations that may indicate XSS exploitation attempts
• Monitor browser console logs and network traffic for signs of script execution attempting to access window.parent
• Audit user activity logs for unauthorized configuration changes to Application Prologues

Monitoring Recommendations

• Deploy web application firewall (WAF) rules to detect and block requests containing suspicious iframe_render payloads
• Enable logging and alerting on changes to Application Prologue configurations within the MaxKB administrative interface
• Monitor for unusual API call patterns that could indicate session hijacking or unauthorized actions performed via XSS

How to Mitigate CVE-2026-39426

Immediate Actions Required

• Upgrade MaxKB to version 2.8.0 immediately, which contains the fix for this vulnerability
• Review and audit all existing Application Prologue configurations for malicious content
• Implement Content Security Policy headers to restrict script execution sources
• Consider temporarily disabling custom iframe_render functionality if upgrade is not immediately possible

Patch Information

The vulnerability has been addressed in MaxKB version 2.8.0. Organizations should prioritize upgrading to this version to eliminate the XSS vulnerability. The fix is documented in the GitHub Release v2.8.0 and detailed in the GitHub Security Advisory GHSA-q2qg-43vq-f2wv.

Workarounds

• Sanitize all Application Prologue configurations by removing any <iframe_render> tags until the upgrade can be completed
• Implement network-level controls to restrict access to the MaxKB administrative interface to trusted networks only
• Deploy Content Security Policy headers with strict script-src directives to limit JavaScript execution contexts
• Consider using a web application firewall to filter out potentially malicious iframe_render content

# Content Security Policy header example for nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; frame-src 'none'; frame-ancestors 'self';" always;