CVE-2026-82881

5.1 mediumEPSS 0.3%

Medium (5.1). EPSS 0.3% chance of exploitation in the next 30 days.

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-08-31
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/apconw/Aix-DB
https://github.com/apconw/Aix-DB/blob/v1.2.4/web/src/components/MarkdownPreview/plugins/markdown.ts#L36
https://github.com/apconw/Aix-DB/commit/b568a0f3b18ecead9f7d38bb78017f664d54a1a9
https://github.com/apconw/Aix-DB/issues/230
https://github.com/apconw/Aix-DB/pull/231

Check your stack JSON