1millionbot AI Chat CVE-2026-91921

Exploitation requires the client-side rendering engine of the 1millionbot AI chatbot widget to process attacker-supplied chat messages containing Markdown syntax and specific unsanitised content blocks; no authentication is needed (PR:N) but active user interaction is required (UI:A) to submit and render the content. The critical limiting factor is that impact is confined to the attacker's own interactive session - the flaw does not render injected content to other users, admin panels, or backend systems, so it cannot be used to hijack third-party sessions or reach internal infrastructure. This makes it materially closer to self-XSS/link-injection than to a cross-victim stored XSS.

This is a low-real-risk issue despite the network attack vector. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N, base 5.1) already reflects the sharply bounded impact: the only affected metrics are VI:L and SI:L, with confidentiality and availability set to None. The description explicitly states the impact is confined to the user's own interactive session, with no compromise of internal infrastructure, third-party data, or administrative panels - this is effectively a self-XSS / limited hyperlink-injection issue rather than a session-hijacking or infrastructure-compromise XSS. UI:A confirms active user interaction is required to trigger rendering. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active exploitation or automated weaponization. Net: a genuine input-sanitization defect worth patching, but not an urgent priority relative to standard stored/reflected XSS that can steal sessions.

A remote unauthenticated user submits chat messages containing Markdown syntax and unsanitised content blocks to the 1millionbot AI chatbot widget, causing external hyperlinks to be rendered in the client-side chat interface. Because the impact is limited to the sender's own interactive session (UI:A required), this behaves as self-inflicted content injection rather than an attack that pivots to other users or backend systems. No public exploit code was identified at time of analysis.