Vulnerability Description
FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/xpf0000/FlyEnv/commit/68fd6d7b200273ad0a8bce09424b8bd87134cfb
- https://github.com/xpf0000/FlyEnv/issues/809
- https://github.com/xpf0000/FlyEnv/pull/810
- https://github.com/xpf0000/FlyEnv/releases/tag/v4.18.0
- https://www.vulncheck.com/advisories/flyenv-cross-site-scripting-via-v-html
FAQ
What is CVE-2026-69116?
CVE-2026-69116 is a vulnerability with a CVSS score of 6.1 (MEDIUM). FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat message...
How severe is CVE-2026-69116?
CVE-2026-69116 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-69116?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.