Description
A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message.
Published: 2026-06-09
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a cross‑site scripting flaw triggered by markdown content in the chat function of FastapiAdmin 2.2.0. An attacker can craft a chat message containing HTML or script tags that are rendered without proper sanitization, allowing the execution of arbitrary client‑side code in the context of the web application. This could lead to theft of session cookies, credential hijacking, or defacement of the user interface.

Affected Systems

FastapiAdmin version 2.2.0.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate impact. The exploit is performed through the chat input, so the likely attack vector is via user‑generated messages. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Defenses against XSS rely on proper input validation or output encoding. If unpatched, the flaw remains exploitable on any deployment of the affected product.

Generated by OpenCVE AI on June 9, 2026 at 22:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FastapiAdmin to a version that contains the XSS fix.
  • Configure the chat component to sanitize or escape HTML before rendering markdown content.
  • Implement a content‑security‑policy header that restricts script execution to trusted origins.

Generated by OpenCVE AI on June 9, 2026 at 22:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 10 Jun 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Fastapiadmin
Fastapiadmin fastapiadmin
Vendors & Products Fastapiadmin
Fastapiadmin fastapiadmin

Tue, 09 Jun 2026 22:15:00 +0000

Type Values Removed Values Added
Title Markdown‑based XSS in FastapiAdmin Chat Function

Tue, 09 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Tue, 09 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 18:45:00 +0000

Type Values Removed Values Added
Description A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message.
References

Subscriptions

Fastapiadmin Fastapiadmin
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-06-09T21:04:04.925Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-36728

cve-icon Vulnrichment

Updated: 2026-06-09T19:10:39.156Z

cve-icon NVD

Status : Received

Published: 2026-06-09T19:17:43.327

Modified: 2026-06-09T22:16:25.033

Link: CVE-2026-36728

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-10T00:30:16Z

Weaknesses