MaxKB, an open‑source AI assistant, contains a stored cross‑site scripting flaw in versions 2.7.1 and earlier. The front‑end component that renders LLM responses and application prologue configurations accepts custom <iframe_render> tags without sanitization. These tags are passed to a dedicated renderer that embeds the supplied HTML into an <iframe> using the srcdoc attribute. The sandbox on that iframe allows scripts to run and escape via window.parent, giving attackers a powerful route to execute JavaScript in the parent page.

The vulnerability affects the 1Panel‑dev MaxKB product for all releases through 2.7.1. Any deployment that stores unfiltered LLM output or uses custom prologue settings is vulnerable; the flaw is fixed starting with version 2.8.0.

The CVSS score of 5.1 labels the issue as medium severity, and no EPSS estimate is available. Because the exploit merely requires the insertion of a malicious <iframe_render> tag into stored content, the barrier to attack is low for anyone with the ability to modify LLM output or configure the application prologue. The flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, but its stored nature means that all users who view the compromised chat can be affected, allowing session hijacking, unauthorized actions, and data exposure.