CVE-2026-36725

Vulnerability

A markdown-based Cross-Site Scripting (XSS) vulnerability exists in FastapiAdmin versions 2.2.0 and earlier. The vulnerability resides in the /system/notice/create endpoint, where the notice_content parameter is accepted without proper sanitization or validation. This allows for the injection of arbitrary web scripts or HTML, which are then stored and rendered by the wangEditor component on the frontend without further sanitization [1].

Exploitation

An authenticated attacker can exploit this vulnerability by crafting a malicious payload containing JavaScript code and submitting it via the notice_content parameter to the /system/notice/create endpoint. When a user views the notice containing this payload, the injected script will execute in their browser [1].

Impact

Successful exploitation allows an attacker to execute arbitrary web scripts in the context of the victim's browser. This can lead to various security compromises, including session hijacking, credential theft, or performing malicious actions on behalf of the victim, depending on the privileges of the user viewing the notice [1].

Mitigation

To mitigate this vulnerability, it is recommended to implement HTML sanitization using libraries like DOMPurify before rendering content with wangEditor, or to use a markdown editor with built-in XSS protection such as mavonEditor. Additionally, implementing Content Security Policy (CSP) headers can help reduce the impact of XSS attacks. The fixed version and release date are not yet disclosed in the available references [1].