CVE-2026-8335

HighCVSS 7.1

Published: 10/06/2026(UTC)Updated: 10/06/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.02%

7th percentile - higher than 7% of all known CVEs

Summary

A missing authentication check on the Aix-DB '/llm/process_llm_out' endpoint allows unauthenticated clients to execute arbitrary 'SELECT' SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints.

Risk Assessment

The organization is exposed to unauthorized access to database data, which may lead to information leakage and violation of user privacy.

Recommendation

It is recommended to implement appropriate authentication mechanisms for the '/llm/process_llm_out' endpoint and to update to the latest software version as soon as a patch becomes available.

Other vulnerabilities in Aix-DB

CVE-2026-82881Medium
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.

Original NVD description (English source)

A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.