CVE-2026-39426

MaxKB (enterprise open-source AI assistant) contains a Stored XSS in versions 2.7.1 and earlier. The vulnerability arises in MdRenderer.vue, which parses custom tags from LLM responses or Prologue configurations and bypasses Markdown sanitization. Unsanitized HTML is passed to IframeRender.vue a...