CVE-2026-90602

LowCVSS 3.5

Published: 13/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 14/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0 in the renderHistory function of ImageStudio.js of the Studio Components. This manipulation causes cross-site scripting (XSS). The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

Risk Assessment

A remote attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft or other actions in the user's context.

Recommendation

Track the fixing pull request and apply it once accepted. In the meantime, consider restricting access to the application or implementing additional XSS filters.

Other vulnerabilities in Open-Generative-AI

CVE-2026-90603High
A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e.

Original NVD description (English source)

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS