CVE-2026-69116

MEDIUM 6.1

FlyEnv < 4.18.0 Cross-Site Scripting via v-html

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.

CWE	CWE-79
Vendor	xpf0000
Product	flyenv
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for xpf0000 flyenv

Be the first to know when new medium vulnerabilities affecting xpf0000 flyenv are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

xpf0000 / FlyEnv

0 < 4.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/xpf0000/FlyEnv/issues/809 github.com: https://github.com/xpf0000/FlyEnv/releases/tag/v4.18.0 github.com: https://github.com/xpf0000/FlyEnv/pull/810 github.com: https://github.com/xpf0000/FlyEnv/commit/68fd6d7b200273ad0a8bce09424b8bd87134cfb6 vulncheck.com: https://www.vulncheck.com/advisories/flyenv-cross-site-scripting-via-v-html

Credits

YU SUN