FastapiAdmin vulnerabilities

The AI assistant chat function in FastapiAdmin v2.2.0 has a Markdown-based XSS vulnerability. Attackers can inject arbitrary scripts or HTML by sending a crafted chat message.

FastapiAdmin version v2.2.0 contains a Markdown-based XSS vulnerability in the /system/notice/create endpoint. Attackers can inject malicious JavaScript or HTML into the notice_content parameter, which will be executed in the victim's browser.

An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_task:job:update permission to cause a Denial of Service (DoS) by manipulating the func field of scheduled tasks.