Junglewise Threat Intelligence

CVE-2025-15632: 1Panel-dev MaxKB stored XSS in MdPreview component

CVE-2025-15632 · Severity: low · CVSS 3.5 · Published 2026-04-13

Technologies: 1Panel-dev MaxKB. Vendors: 1Panel-dev.

Executive brief

1Panel-dev MaxKB is an open-source platform used to build enterprise-grade AI agents and knowledge bases. A security vulnerability in the platform's chat and document preview components allows an attacker to inject malicious scripts into shared content. If a user or administrator views this content, the script could execute in their browser, potentially leading to unauthorized actions or the theft of session information within the application.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the MdPreview component of MaxKB, specifically within 'ui/src/chat.ts' and related paragraph preview components. The root cause is the improper sanitization of user-supplied Markdown/HTML content before it is rendered by the 'md-editor-v3' library. An authenticated attacker with dataset management permissions can submit a malicious payload (e.g., via the 'content' parameter in the paragraph API) which is stored in the database. When another user views the affected content, the unsanitized HTML is executed in their browser context. The vendor addressed this in version 2.5.0 by implementing the 'xss' library and 'XSSPlugin' for 'md-editor-v3' to enforce a whitelist-based sanitization policy.

Affected products

  • 1Panel-dev MaxKB up to 2.4.2

Timeline

  • 2025-12-29: patched: Patch commit 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8 merged into v2 branch.
  • 2026-01-08: advisory: Version 2.5.0 released with security fixes.
  • 2026-03-18: disclosed: Public exploit details published on GitHub.
  • 2026-04-13: other: CVE-2025-15632 published.

References