CVE-2026-36728
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The AI assistant chat function in FastapiAdmin v2.2.0 has a Markdown-based XSS vulnerability. Attackers can inject arbitrary scripts or HTML by sending a crafted chat message.
Risk Assessment
Attackers can execute scripts in the victim's browser while using the chat, potentially leading to session theft or data leakage.
Recommendation
Update FastapiAdmin to a version above 2.2.0. Sanitize input in the chat function, especially for Markdown formatting.
Other vulnerabilities in FastapiAdmin
See all- CVE-2026-36725Medium
FastapiAdmin version v2.2.0 contains a Markdown-based XSS vulnerability in the /system/notice/create endpoint. Attackers can inject malicious JavaScript or HTML into the notice_content parameter, which will be executed in the victim's browser.
- CVE-2026-36724Medium
An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_task:job:update permission to cause a Denial of Service (DoS) by manipulating the func field of scheduled tasks.
Original NVD description (English source)
A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message.