CVE-2026-69116
Received Received - Intake

FlyEnv Electron App HTML Injection via Markdown and AI Chat

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description
FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-69116
EUVD
EUVD-2026-55796

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flyenv flyenv to 4.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FlyEnv before version 4.18.0 does not properly sanitize HTML content from markdown rendering or AI chat messages. This allows attackers to inject malicious scripts via markdown or chat inputs that are rendered using Vue's v-html directive. These scripts execute in the Electron renderer process with access to Node.js APIs and the filesystem.

Detection Guidance

Detecting this vulnerability requires checking for FlyEnv versions before 4.18.0 and inspecting markdown or chat content rendered via Vue v-html directives for script injection. Review application logs for unusual HTML/script tags in user-provided markdown or chat messages. Check Electron renderer process logs for unexpected Node.js API access or filesystem operations.

Impact Analysis

An attacker could exploit this to run arbitrary code on your system, steal sensitive data, or perform actions on your behalf. Since the renderer process has filesystem access, files could be read, modified, or deleted. Malicious scripts could also capture user inputs or session tokens.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected FlyEnv versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade FlyEnv to version 4.18.0 or later to address the HTML sanitization flaw in markdown and AI chat content rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69116. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart