CVE-2026-82881Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Descripción

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/apconw/Aix-DB/issues/230 issue-tracking
• https://github.com/apconw/Aix-DB/pull/231 patchissue-tracking
• https://github.com/apconw/Aix-DB/commit/b568a0f3b18ecead9f7d38bb78017f664d54a1a9 patch
• https://github.com/apconw/Aix-DB/blob/v1.2.4/web/src/components/MarkdownPreview/plugins/markdown.ts#L36 technical-description
• https://github.com/apconw/Aix-DB product
• VulnCheck Advisory: Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown third-party-advisory