A markdown‑based cross‑site scripting vulnerability exists in the /system/notice/create endpoint of FastapiAdmin v2.2.0. Attackers can inject crafted payloads into the notice_content field, which are rendered as raw HTML. When a privileged user views the notice, the injected script executes in the browser context, allowing the attacker to steal session data, perform actions on behalf of the user, or redirect traffic.

FastapiAdmin version 2.2.0 is affected.

The vulnerability can be exploited with minimal skill by providing a malicious notice via an authenticated session. No EPSS score is available, but the lack of mitigation in the application and absence from the CISA KEV list does not reduce the potential impact. Attackers can steal credentials, deface the UI, or execute further attacks in the target environment. The CVSS score of 6.1 indicates a moderate severity.