Cross-Site Scripting Vulnerability in Anil-matcha's Open-Generative-AI Application
CVE-2026-90602

5.1MEDIUM

Key Information:

Vendor

Anil-matcha

Status
Open-generative-ai
Vendor
CVE Published:
13 September 2026

What is CVE-2026-90602?

A cross-site scripting vulnerability exists in Anil-matcha's Open-Generative-AI affecting versions up to 1.0.11 and 2.0.0. This vulnerability is linked to the 'renderHistory' function within the 'ImageStudio.js' file of the Studio Components. An attacker could exploit this flaw to execute arbitrary scripts in the context of the user's session, potentially leading to unauthorized access and data exposure. The resolution for this issue is currently pending as the relevant pull request awaits acceptance.

Affected Version(s)

Open-Generative-AI 1.0.0

Open-Generative-AI 1.0.1

Open-Generative-AI 1.0.2

References

https://vuldb.com/vuln/403184
vdb-entrytechnical-description
https://vuldb.com/vuln/403184/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90602
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Default01 (VulDB User)
VulDB CNA Team
.