medium6.1
CVE-2026-69116
FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives.
Impact
FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.
Affected products
| Product | Affected versions |
|---|---|
| FlyEnv | before 4.18.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/xpf0000/FlyEnv/commit/68fd6d7b200273ad0a8bce09424b8bd87134cfb6
- https://github.com/xpf0000/FlyEnv/issues/809
- https://github.com/xpf0000/FlyEnv/pull/810
- https://github.com/xpf0000/FlyEnv/releases/tag/v4.18.0
- https://www.vulncheck.com/advisories/flyenv-cross-site-scripting-via-v-html