CVE-2026-69116 in FlyEnv

Résumé

par MITRE • 10/08/2026

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsable: VulnCheck
• Réserver: 03/08/2026
• Divulgation: 10/08/2026
• Modérer: accepté
• Entrée: VDB-387886
• CPE: prêt
• CWE: CWE-74 (confirmé)
• CVSS: 5.5 (VulDB)
• EPSS: 0.00000
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-69116
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69116
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-69116/