CVE-2026-90602

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90602
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90602.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90602
Published
2026-09-13T22:45:16Z
Modified
2026-09-14T11:45:31Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting
Details

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90602.json"
}
References

Affected packages

Git / github.com/anil-matcha/open-generative-ai

Affected ranges

Type
GIT
Repo
https://github.com/anil-matcha/open-generative-ai
Events
Introduced
38ce0ecbf1b9c906dfd4fc13252ee7f72d46c2c9
Last Affected
0bc974433d660639bc0c888bb9423c9316c12f0a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "introduced": "1.0.1"
        },
        {
            "last_affected": "1.0.1"
        },
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2"
        },
        {
            "introduced": "1.0.3"
        },
        {
            "last_affected": "1.0.3"
        },
        {
            "introduced": "1.0.4"
        },
        {
            "last_affected": "1.0.4"
        },
        {
            "introduced": "1.0.5"
        },
        {
            "last_affected": "1.0.5"
        },
        {
            "introduced": "1.0.6"
        },
        {
            "last_affected": "1.0.6"
        },
        {
            "introduced": "1.0.7"
        },
        {
            "last_affected": "1.0.7"
        },
        {
            "introduced": "1.0.8"
        },
        {
            "last_affected": "1.0.8"
        },
        {
            "introduced": "1.0.9"
        },
        {
            "last_affected": "1.0.9"
        },
        {
            "introduced": "1.0.10"
        },
        {
            "last_affected": "1.0.10"
        },
        {
            "introduced": "1.0.11"
        },
        {
            "last_affected": "1.0.11"
        },
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.0
1.0.1
1.0.10
1.0.11
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
2.*
2.0
v1.*
v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.2
v1.0.3-binaries
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v2.*
v2.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90602.json"