Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck
CVE-2026-82881Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown
Medium 5.4
In plain English
A medium-severity cross-site scripting in Aix-DB from apconw. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 75.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/apconw/Aix-DB/issues/230 issue-tracking
- https://github.com/apconw/Aix-DB/pull/231 patch, issue-tracking
- https://github.com/apconw/Aix-DB/commit/b568a0f3b18ecead9f7d38bb78017f664d54a1a9 patch
- https://github.com/apconw/Aix-DB/blob/v1.2.4/web/src/components/MarkdownPreview/plugins/markdown.ts#L36 technical-description
- https://github.com/apconw/Aix-DB product
- VulnCheck Advisory: Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown third-party-advisory