CVE-2026-82881: Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to submit or modify markdown content in a chat response, skill description, or knowledge message. Exploitation also requires a victim to view the affected content in their browser.
Are default markdown renderings affected?
The issue affects markdown rendering where raw HTML is enabled and rendered through v-html bindings without sanitization. The provided data does not establish whether raw HTML is enabled in every default deployment or configuration.
What can happen when malicious content is viewed?
Injected HTML and JavaScript can execute in the viewing user's browser. The vulnerability is described as stored XSS, so the payload may remain in saved content and execute for later viewers.
How can administrators identify potentially affected content?
Review chat responses, skill descriptions, and knowledge messages for untrusted or unexpected raw HTML and JavaScript-capable markup. Content rendered through unsanitized v-html markdown bindings is the relevant exposure path.