MaxKB: Prompt-injectable agent can lead to command execution

MaxKB vulnerable to privilege escalation through sandbox bypass

MaxKB has RCE in MCP call

MaxKB AWS Bedrock model credential injection leads to remote code execution

MaxKB MCP tool import validation bypass allows post-authentication remote code execution

MaxKB has SSRF in sandbox

MaxKB Python Sandbox Bypass in Function Library

1Panel-dev MaxKB Knowledge Base Module csv injection

MaxKB: Webhook Trigger Authentication Bypass

MaxKB has a Python sandbox LD_PRELOAD bypass

MaxKB: Cross-workspace model parameter form write

MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect

MaxKB: Sandbox escape via LD_PRELOAD bypass

MaxKB: SSRF via sandbox network hook bypass

MaxKB has a reverse shell vulnerability in function library

MaxKB RCE vulnerability in function library

MaxKB: Unsalted MD5 Password Hashing

MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation

MaxKB has Information Leak in sandbox

MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

MaxKB: Sandbox escape via unhooked fexecve

MaxKB: Unauthenticated SSRF via Workflow Template Import

MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy

1Panel-dev MaxKB debug deserialization

MaxKB sandbox bypass

MaxKB: RCE via MCP stdio command injection in workflow engine

MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base

MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application

MaxKB: Expired application API keys remain usable on `/chat/api/mcp`

MaxKB: Stored XSS via Unsanitized iframe_render Parsing

MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering

Stored XSS via Eval Injection in EchartsRander Component

MaxKB has Stored XSS via ChatHeadersMiddleware

MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation

MaxKB: Broken Access Control in MaxKB OSS URL Fetch API

MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch

MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows

MaxKB has CSV Injection in its Application Chat Export Functionality

MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)

MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id

MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing