Vulnerability Description
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/apconw/Aix-DB
- https://github.com/apconw/Aix-DB/blob/v1.2.4/web/src/components/MarkdownPreview/
- https://github.com/apconw/Aix-DB/commit/b568a0f3b18ecead9f7d38bb78017f664d54a1a9
- https://github.com/apconw/Aix-DB/issues/230
- https://github.com/apconw/Aix-DB/pull/231
- https://www.vulncheck.com/advisories/aix-db-through-1.2.4-stored-cross-site-scri
- https://github.com/apconw/Aix-DB/issues/230
FAQ
What is CVE-2026-82881?
CVE-2026-82881 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript ...
How severe is CVE-2026-82881?
CVE-2026-82881 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82881?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.