CVE-2026-36728 identifies a markdown-based XSS vulnerability in the AI assistant chat feature of FastapiAdmin version 2.2.0. An attacker can inject malicious scripts or HTML via specially crafted chat messages, potentially leading to cross-site scripting attacks. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No patch or official remediation level has been published yet.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure or manipulation of the user interface. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and is remotely exploitable without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the AI assistant chat function or sanitizing inputs at the application level to mitigate injection of malicious markdown content.