CVE-2026-91921Disclosure

LOWCVSS 5.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax and certain unsanitised content blocks. The impact is limited to the user’s own interactive session; no compromise of internal infrastructure, access to third-party data or impact on administrative panels has been identified.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-1millionbots-ai-chatbot-platform

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-09-21); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-21	1	Disclosure1
2026-10-24	1	Patch1

Full discourse2 posts

Hugo | DevOps | Cybersecurity@HugoValters12d
Patch
CVE-2026-91921: XSS in 1millionbot AI Chat via unsanitised Markdown links, CVSS 6.1, patch status unknown. No patch yet - restrict untrusted chat input and watch for updates. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-91921 #1millionbot #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The tweet discloses CVE-2026-91921 as an XSS vulnerability in 1millionbot AI Chat via unsanitised Markdown links (CVSS 6.1), with no patch available yet but a workaround suggested to restrict untrusted chat input.
0000036
1.1K followersView on X
INCIBE-CERT@incibe_cert45d
Disclosure
⚠️#INCIBEaviso | Cross-Site Scripting (XSS) en AI Chatbot Platform de #1millionbot #CVE CVE-2026-91921 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/cross-site-scripting-xss-en-ai-chatbot-platform-de-1millionbot #AvisosDeSeguridad #TI #CNA #0day
Post summary
The tweet is a security alert from INCIBE announcing a Cross-Site Scripting (XSS) vulnerability (CVE-2026-91921) in AI Chatbot Platform, providing a link to the advisory. The text only announces the vulnerability without detailing exploits, active use, or remediation steps.
0000079
56 followersView on X

Explore more

Back to dashboard