CVE-2026-90602
Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting
CVSS Score
3.5
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
| CWE | CWE-79 CWE-94 |
| Vendor | anil-matcha |
| Product | open-generative-ai |
| Published | Sep 13, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for anil-matcha open-generative-ai
Be the first to know when new low vulnerabilities affecting anil-matcha open-generative-ai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Anil-matcha / Open-Generative-AI
1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 1.0.6 1.0.7 1.0.8 1.0.9 1.0.10 1.0.11 2.0
References
vuldb.com: https://vuldb.com/vuln/403184 vuldb.com: https://vuldb.com/vuln/403184/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90602 vuldb.com: https://vuldb.com/submit/914004 github.com: https://github.com/Anil-matcha/Open-Generative-AI/issues/309 github.com: https://github.com/Anil-matcha/Open-Generative-AI/pull/344 github.com: https://github.com/Anil-matcha/Open-Generative-AI/
Credits
🔍 Default01 (VulDB User) VulDB CNA Team