CVE-2026-82881
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.
Risk Assessment
XSS attacks can lead to user session theft, account takeover, and malware distribution. This can compromise data confidentiality and integrity and erode trust in the system.
Recommendation
Update Aix-DB to a version that fixes the vulnerability. Also implement markdown sanitization mechanisms and avoid using v-html with untrusted data.
Other vulnerabilities in Aix-DB
Original NVD description (English source)
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.