CVE-2026-69116

Medium

Description

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.

SeverityMedium

CVSS6.1

Exploit probability—

ProductFlyEnv

PublishedAug 10, 2026

First seenAug 10, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

xpf0000 FlyEnv4.18.0 or later

Patches

github.com/xpf0000/FlyEnv/pull/810
github.com/xpf0000/FlyEnv/commit/68fd6d7b200273ad0a8bce09424b8bd87134cfb6

Vendor advisories

github.com/xpf0000/FlyEnv/releases/tag/v4.18.0

Affected products

Product	Affected versions	Fixed in
xpf0000 FlyEnv	v < 4.18.0	4.18.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.