CVE-2026-39419

Katalog CVE

CVSS 3.1 · Low EPSS 0,35%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada maxkb. Skor CVSS 3.1 3.1 (Low) menurut github.com.

Deskripsi (NVD)

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandbox result validation and spoof tool execution results by exploiting Python frame introspection to read the wrapper's UUID from its bytecode constants, then writing a forged result directly to file descriptor 1 (bypassing stdout redirection). By calling sys.exit(0), the attacker terminates the wrapper before it prints the legitimate output, causing the MaxKB service to parse and trust the spoofed response as the genuine tool result. This issue has been fixed in version 2.8.0.

Rincian

Terbit di NVD

14 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-290: Authentication Bypass by Spoofing
CWE-693: Protection Mechanism Failure

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f3c8-p474-xwfv advisory vendor
• https://github.com/1Panel-dev/MaxKB/commit/38c4cfecd065293ede0437f6fa76cf0116591d25 patch
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 release notes