CVE-2026-36728 Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the AI assistant chat feature of FastapiAdmin versions through 2.2.0. This issue allows authenticated attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into a chat message. The vulnerability arises because user-supplied content is stored in the database without proper sanitization or validation, and is rendered on the frontend using markdown-it, which lacks built-in XSS protection. As a result, injected JavaScript can execute in the browsers of users viewing the chat messages or the message management page, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victims.

Users are advised to update to a version of FastapiAdmin that addresses this vulnerability. Additionally, implementing HTML sanitization with libraries like DOMPurify after rendering with markdown-it, using a markdown editor with built-in XSS protection such as mavonEditor, and applying Content Security Policy (CSP) headers can help mitigate this issue.