Description
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| apconw | Aix-DB | ≤ 1.2.4 | — |
References
- https://github.com/apconw/Aix-DB/issues/230 issue-tracking
- https://github.com/apconw/Aix-DB/pull/231 patch issue-tracking
- https://github.com/apconw/Aix-DB/commit/b568a0f3b18ecead9f7d38bb78017f664d54a1a9 patch
- https://github.com/apconw/Aix-DB/blob/v1.2.4/web/src/components/MarkdownPreview/plugins/markdown.ts#L36 technical-description
- https://github.com/apconw/Aix-DB product
- VulnCheck Advisory: Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown third-party-advisory