A cross‑site scripting flaw exists in the MdPreview component of 1Panel‑dev MaxKB, specifically within the chat.ts file. The vulnerability allows an attacker to inject arbitrary scripts into the application’s user interface. This can compromise the confidentiality, integrity, and availability of the system by executing malicious code in the context of legitimate users. The weakness is categorized under CWE‑79 (XSS) and CWE‑94 (Code Injection), indicating that user input is improperly sanitized before rendering or execution. Attackers may exploit the flaw remotely without needing elevated privileges, using crafted payloads delivered through the chat or preview functionality. The vulnerability is present in all MaxKB releases up to version 2.4.2; the vendor has released a fix in version 2.5.0. The publicly disclosed exploit can be found on GitHub and has already been used in the wild.

The affected product is 1Panel‑dev MaxKB, version 2.4.2 and earlier. Any installation that has not been upgraded to the patched release (v2.5.0) remains vulnerable. The vulnerability affects the MdPreview chat component.

The CVSS score is 5.1, indicating a medium severity. Because the exploit is publicly available on GitHub and the vulnerability is exploitable remotely, the likelihood of attack is significant. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the presence of a public exploit and the straightforward remote execution path raise the risk profile.