EUVD-2026-68467
GHSA-mjx6-rhcw-h3f9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS requires authenticated low-privilege injection (PR:L), passive victim view (UI:R), scope change to victim browser session (S:C), with low C and I impact only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.
AnalysisAI
Stored cross-site scripting in Aix-DB through version 1.2.4 allows authenticated low-privilege users to inject persistent malicious HTML and JavaScript into chat responses, skill descriptions, or knowledge messages, which then execute in other users' browsers when the content is viewed. The root cause is two separate rendering paths - a markdown-it component and a marked-based knowledge view - that both pass rendered HTML directly into Vue.js v-html bindings without sanitization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to hold at minimum a low-privilege authenticated account in the Aix-DB instance with permission to create or edit chat responses, skill descriptions, or knowledge messages - confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) correctly models stored XSS mechanics: the attacker injects once using a low-privilege account (PR:L), the payload fires when a victim passively views the content (UI:P), and impact is confined to the victim's browser session rather than the server itself (VC/VI/VA all N; subsequent-system SC:L/SI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is available at commit b568a0f3b18ecead9f7d38bb78017f664d54a1a9 via GitHub pull request https://github.com/apconw/Aix-DB/pull/231; operators should upgrade to a release that includes this commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated SQL data exfiltration in Aix-DB versions up to and including 1.2.4 allows attackers on adjacent networks
SQL injection in apconw Aix-DB through the terminology_retriever.py module allows local attackers to manipulate the Desc
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today