FlyEnv before version 4.18.0 does not neutralize HTML content properly when rendering markdown or AI chat messages, which are then passed to Vue.js v-html directives without sufficient sanitization. This improper neutralization enables attackers to inject and execute arbitrary scripts in the Electron renderer process context. The Electron environment grants these scripts access to Node.js APIs and the filesystem, increasing the potential impact of the XSS attack. The vulnerability is identified as CVE-2026-69116 with a CVSS 4.0 base score of 5.3 (medium severity). No official patch or remediation level has been stated in the available data.

Successful exploitation allows an attacker to execute arbitrary scripts within the Electron renderer process of FlyEnv. Because this process has access to Node.js APIs and the filesystem, the attacker could potentially perform unauthorized actions on the local system, such as reading or modifying files. The vulnerability requires user interaction (UI:P) and network access (AV:N), but no privileges or authentication are needed to exploit it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted markdown or AI chat content in FlyEnv versions prior to 4.18.0. Consider disabling or restricting features that render markdown or AI chat content via Vue v-html directives if possible.