CVE-2026-77926

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/getanswer or upload documents with maliciou...

CVE-2026-77926 Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/getanswer or upload documents with maliciou...

CVE-2026-77926

Aix-DB 1.2.4 is vulnerable to a remote code execution (RCE) flaw within the ChatBI common agent's ungated deepagents execute tool . This vulnerability allows authenticated non-admin users to execute arbitrary operating system commands on the host. Attackers can trigger this by sending crafted cha...

EUVD-2026-104686

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/getanswer or upload documents with maliciou...

CVE-2026-77926 Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/getanswer or upload documents with maliciou...

CVE-2026-77926 Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/getanswer or upload documents with maliciou...

PT-2026-117948

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get answer or upload documents with malicio...

CVE-2026-82881

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

CVE-2026-82881

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

CVE-2026-82881

Aix-DB through version 1.2.4 is vulnerable to stored cross-site scripting (XSS) . The root cause is that markdown is rendered with raw HTML enabled and bound to v-html without sanitization (specifically in web/src/components/MarkdownPreview/plugins/markdown.ts). An attacker with low privileges ca...

EUVD-2026-68467

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

CVE-2026-82881: Improper Neutralization of Input During Web Page Generation

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

PT-2026-83785

Name of the Vulnerable Software and Affected Versions Aix-DB versions 1.0 through 1.2.4 Description The software renders markdown with raw HTML enabled into v-html bindings without proper sanitization, leading to stored cross-site scripting. This allows attackers to inject malicious HTML and...

CVE-2026-8335

A missing authentication check on the Aix‑DB "/llm/processllmout" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are...

CVE-2026-8335

A missing authentication check on the Aix‑DB "/llm/processllmout" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are...

CVE-2026-8335 Missing authentication in Aix-DB

A missing authentication check on the Aix‑DB "/llm/processllmout" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are...

CVE-2026-8335

CVE-2026-8335 affects Aix-DB. A missing authentication check on the "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary SQL (e.g., arbitrary SELECTs) and retrieve database data, because token validation enforced on other endpoints is absent here. All releases up to...