CVE-2026-69116 — FlyEnv < 4.18.0 Cross-Site Scripting via v-html
FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown …
Published: 2026-08-10 · CVSS: 5.3 · CVSS 4.0
FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7