We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-69116

CVE-2026-69116

Node.js

Severity: MEDIUM
CVSS: 6.1CVSS
Published: 2026-08-10
Last modified: 2026-08-10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79

Description

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.

References

https://github.com/xpf0000/FlyEnv/commit/68fd6d7b200273ad0a8bce09424b8bd87134cfb6
https://github.com/xpf0000/FlyEnv/issues/809
https://github.com/xpf0000/FlyEnv/pull/810
https://github.com/xpf0000/FlyEnv/releases/tag/v4.18.0
https://www.vulncheck.com/advisories/flyenv-cross-site-scripting-via-v-html

Summary

Description

References