Vulnerabilities CVE-2026-69116

CVE-2026-69116

Medium

Open

TLP:CLEAR

FlyEnv < 4.18.0 Cross-Site Scripting via v-html

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.

Details

CVSS Score: 5.3
EPSS Score ⓘ: 0.24%

15.7th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Confidence: 90%
Published: Aug 10, 2026
Last Modified: Aug 11, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.