CVE-2026-36728: XSS

Published Jun 9, 2026

Updated

A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message.

Affected Software

1 affected component

FastApiAdmin FastApiAdmin=2.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove FastapiAdmin AI assistant chat function from your environment.
Uninstall or remove the AI assistant chat component or plugin from deployments where it is not required.
Configuration
Disable the AI assistant chat function in FastapiAdmin until an official fix is available.
FastapiAdmin AI assistant chat enabled = false
Compensating control
Restrict access to the AI assistant chat feature to trusted/internal networks and authenticated administrators (for example via firewall rules, ACLs, or reverse proxy) to reduce exposure.
Compensating control
Deploy input validation or a web application firewall (WAF) to block or sanitize script/HTML payloads in chat messages to mitigate XSS payload delivery.
Operational
Review chat logs and message history for injected script/HTML payloads, remove malicious messages, and monitor for signs of exploitation until a patch is applied.

Event History

Jun 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs access sufficient to submit a chat message to the AI assistant chat function and must persuade a victim to view or otherwise interact with the crafted content. The CVSS vector indicates low attack complexity, low privileges required, and user interaction required.

Which deployments are affected?

The reported affected version is FastapiAdmin v2.2.0. The issue is specifically in the AI assistant chat function's handling of markdown-based chat messages.

What is the potential impact on a successful exploit?

A crafted chat message can cause arbitrary HTML or web script to execute in a victim's browser. The CVSS vector indicates limited confidentiality and integrity impact, with no availability impact, and scope change.