CVE-2026-36728 — A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message

Back Back to CVE browser

MEDIUM

A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message

Published Jun 9, 2026

5.4

MEDIUM

CVSS 3.1

EPSS 0.23%

Description

A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.23% 0.00226

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00226

Score over time

Jun–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.23% (0.00226)	12.09th	v5 (v2026.06.15)
Jun 15, 2026	0.16% (0.00162)	5.72th	v5 (v2026.06.15)
Jun 10, 2026	0.03% (0.00029)	8.68th	v4 (v2025.03.14)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-7

Link	Providers	Tags
https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-7

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 9, 2026

Updated Jun 9, 2026

Reserved Apr 6, 2026

Link CVE-2026-36728

CISA Vulnrichment

Updated Jun 9, 2026

NVD

Status Deferred

Modified Jul 23, 2026

Link CVE-2026-36728

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-36728