CVE-2026-91921
Medium
Description
Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax and certain unsanitised content blocks. The impact is limited to the user’s own interactive session; no compromise of internal infrastructure, access to third-party data or impact on administrative panels has been identified.
SeverityMedium
CVSS5.1
Exploit probability—
ProductAI Chatbot Platform (SaaS) de 1millionbot.
PublishedSep 21, 2026
First seenSep 21, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 1millionbot AI Chatbot Platform (SaaS) de 1millionbot. | Version prior to CVE publication | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.