CVE-2026-91921
Received Received - Intake

Cross-Site Scripting in 1millionbot AI Chat Platform

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax and certain unsanitised content blocks. The impact is limited to the user’s own interactive session; no compromise of internal infrastructure, access to third-party data or impact on administrative panels has been identified.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-91921
EUVD
EUVD-2026-83880

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
1millionbot ai_chatbot_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-91921 is a Cross-Site Scripting (XSS) vulnerability in the 1millionbot AI Chat Platform. It occurs due to insufficient input sanitization in the client-side rendering engine. An attacker can send messages with unsanitized Markdown syntax to inject external hyperlinks into the web interface.

Detection Guidance

To detect this XSS vulnerability, monitor web traffic for unsanitized Markdown syntax or external hyperlinks in user messages. Check browser console logs for rendered scripts or unexpected content in the 1millionbot AI Chatbot Platform interface.

Impact Analysis

The vulnerability allows an unauthenticated remote user to manipulate the web interface during your session by rendering malicious hyperlinks. However, it does not compromise internal systems, access third-party data, or affect administrative panels. The impact is limited to your own interactive session.

Mitigation Strategies

Apply the latest patch from 1millionbot to fix the input sanitization issue. If no patch is available, restrict user input to trusted sources and disable Markdown rendering temporarily until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart