A Cross-Site Scripting (XSS) vulnerability exists in the processing of SVG images submitted to the /api/v2/ai/sessions API when using the data:image/svg+xml;base64 format. Embedded script tags in the SVG are executed when rendered in the assistant window, enabling JavaScript execution and content manipulation.