CVE-2026-36725 Details

A Cross-Site Scripting (XSS) vulnerability has been identified in FastapiAdmin versions through 2.2.0. The issue arises in the system notice functionality, specifically within the '/api/v1/system/notice/create' endpoint. This endpoint allows authenticated users to submit notices via the 'notice_content' parameter without proper sanitization or validation. The injected content is stored in the database and later rendered on the frontend using WangEditor, which lacks built-in XSS protection. Consequently, this vulnerability enables the injection of arbitrary JavaScript that could execute in the browsers of users viewing the notice, potentially leading to session hijacking or credential theft.

Users are advised to update FastapiAdmin to a version later than 2.2.0. Additionally, implement HTML sanitization before rendering with WangEditor, consider using a markdown editor with built-in XSS protection, and apply Content Security Policy headers.