CVE-2026-82881: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apconw Aix-DB

CVE-2026-82881 describes a stored cross-site scripting vulnerability in apconw's Aix-DB product through version 1.2.4. The product renders markdown content with raw HTML enabled into v-html bindings without sanitization, enabling attackers to inject malicious HTML and JavaScript. This malicious code executes in the context of users' browsers when they view affected content such as chat responses, skill descriptions, or knowledge messages. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity, with network attack vector, low attack complexity, and requiring user interaction.

Successful exploitation allows an attacker to execute arbitrary HTML and JavaScript in the browsers of users viewing the injected content. This can lead to theft of user credentials, session tokens, or other sensitive information accessible via the browser, as well as potential manipulation of the user interface or actions performed on behalf of the user. The vulnerability requires the victim to view maliciously crafted markdown content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid rendering untrusted markdown content with raw HTML enabled. Applying input sanitization or disabling raw HTML rendering in markdown processing can mitigate the risk. Monitor vendor channels for official patches or updates addressing this vulnerability.