MaxKB versions 2.7.1 and earlier allow authenticated users to inject malicious HTML and JavaScript into the Application prologue field by wrapping payloads inside <html_rander> tags. Because the backend does not sanitize or encode this input and the frontend renders it with an innerHTML‑equivalent, a persistent DOM‑based Stored XSS is established. The vulnerability is an instance of CWE‑80, which describes improper neutralization of text passed to a web browser. An attacker can hijack sessions, perform unauthorized actions such as deleting workspaces or applications, and exfiltrate sensitive data.

The flaw affects the 1Panel‑dev MaxKB AI assistant. All releases up through 2.7.1 are vulnerable; users should upgrade to version 2.8.0 or later to eliminate the risk.

The CVSS base score of 5.1 indicates moderate severity, while EPSS data is unavailable and the issue is not in CISA’s KEV catalog. Exploitation requires the attacker to be an authenticated user with permission to modify an application via the /admin/api/workspace/{workspace_id}/application REST endpoint. Once the malicious prologue is stored, any visitor to the chatbot interface will encounter the injected script, enabling cross‑site attacks.