CVE-2026-69116CWE-79cross-site-scripting

CVE-2026-69116

Medium · published August 11, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-11T00:17Z
References (5)
https://github.com/xpf0000/FlyEnv/commit/68fd6d7b200273ad0a8bce09424b8bd87134cfb6 · [email protected]https://github.com/xpf0000/FlyEnv/issues/809 · [email protected]https://github.com/xpf0000/FlyEnv/pull/810 · [email protected]https://github.com/xpf0000/FlyEnv/releases/tag/v4.18.0 · [email protected]https://www.vulncheck.com/advisories/flyenv-cross-site-scripting-via-v-html · [email protected]
EPSS history
Timeline
  • 10 AUG 19:35Z
    FlyEnv < 4.18.0 Cross-Site Scripting via v-html
    cvelistv5