CVE-2026-39424: MaxKB has CSV Injection in its Application Chat Export Functionality
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable to Improper Neutralization of Formula Elements in a CSV File. When an administrator exports the application chat history to an Excel file (.xlsx) via the /admin/api/workspace/{workspaceid}/application/{applicationid}/chat/export endpoint, strings starting with formula characters are written directly without proper sanitization. Opening this file in spreadsheet applications like Microsoft Excel can lead to Arbitrary Code Execution (RCE) on the administrator's workstation via Dynamic Data Exchange (DDE). The issue is a variant of CVE-2025-4546, which fixed the exact same pattern in apps/dataset/serializers/documentserializers.py but missed the application chat export sink. This issue has been fixed in version 2.8.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39424?
The severity of CVE-2026-39424 is considered high due to the potential exploitation of CSV injection leading to malicious code execution.
How do I fix CVE-2026-39424?
To fix CVE-2026-39424, upgrade to MaxKB version 2.8.0 or later which addresses the CSV injection vulnerability.
Who is affected by CVE-2026-39424?
CVE-2026-39424 affects users of MaxKB versions 2.7.1 and below who utilize the chat export functionality.
What type of vulnerability is CVE-2026-39424?
CVE-2026-39424 is classified as an Improper Neutralization of Formula Elements in a CSV File vulnerability.
What are the consequences of exploiting CVE-2026-39424?
Exploitation of CVE-2026-39424 could allow an attacker to execute arbitrary code on the victim's machine when they open the exported CSV file.