CVE-2026-39424

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-39424

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39424.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-39424

Aliases

GHSA-rr4r-7cj2-29vp

Published

2026-04-14T00:56:56.625Z

Modified

2026-07-08T08:13:05.392114669Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

MaxKB has CSV Injection in its Application Chat Export Functionality

Details

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable to Improper Neutralization of Formula Elements in a CSV File. When an administrator exports the application chat history to an Excel file (.xlsx) via the /admin/api/workspace/{workspaceid}/application/{applicationid}/chat/export endpoint, strings starting with formula characters are written directly without proper sanitization. Opening this file in spreadsheet applications like Microsoft Excel can lead to Arbitrary Code Execution (RCE) on the administrator's workstation via Dynamic Data Exchange (DDE). The issue is a variant of CVE-2025-4546, which fixed the exact same pattern in apps/dataset/serializers/document_serializers.py but missed the application chat export sink. This issue has been fixed in version 2.8.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39424.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1236"
    ]
}

References

Affected packages

Git / github.com/1panel-dev/maxkb

Affected ranges

Type

GIT

Repo

https://github.com/1panel-dev/maxkb

Events

Introduced

Fixed

f0a73da5d9ee22e6374dabd4da1081569659530c

Fixed

24cd68acae5f726eed828e2ac801827a2a70536f

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:maxkb:maxkb:*:*:*:*:-:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.8.0"
        }
    ]
}

Affected versions

v0.*

v0.9.0

v0.9.1

v1.*

v1.0.0

v1.0.1

v1.1.0

v1.1.1

v1.1.2

v1.1.3

v1.10.0-lts

v1.10.1-lts

v1.10.2-lts

v1.10.3-lts

v1.10.4-lts

v1.2.0

v1.2.1

v1.3.0

v1.4.0

v1.5.0

v1.6.0

v1.6.1

v1.7.0

v1.9.0

v2.*

v2.0.0

v2.0.1

v2.0.2

v2.1.0

v2.2.0

v2.3.0

v2.4.0

v2.5.0

v2.6.0

v2.6.1

v2.7.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39424.json"