CVE-2026-90602: Open-Generative-AI XSS Vulnerability

CVE-2026-90602 Overview

CVE-2026-90602 is a cross-site scripting (XSS) vulnerability in Anil-matcha Open-Generative-AI versions up to 1.0.11/2.0.0. The flaw resides in the renderHistory function inside ImageStudio.js, part of the Studio Components module. Attackers can exploit the issue remotely by injecting crafted input that the application renders without proper sanitization. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). A pull request addressing the flaw has been submitted upstream but awaits acceptance at the time of publication.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling session data theft, UI manipulation, and phishing pivots against users of the Open-Generative-AI application.

Affected Products

Anil-matcha Open-Generative-AI version 1.0.11
Anil-matcha Open-Generative-AI version 2.0.0
Studio Components module (ImageStudio.js, renderHistory function)

Discovery Timeline

2026-09-13 - CVE-2026-90602 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90602

Vulnerability Analysis

The vulnerability exists in the renderHistory function of ImageStudio.js, a client-side component that displays user history within the Studio Components module. The function inserts stored history data into the Document Object Model (DOM) without adequate output encoding. An attacker who can influence the history data — through prior interaction, shared state, or crafted API input — can plant script payloads that later execute when the history renders. Because the application is an AI-driven web tool, injected scripts may access user prompts, generated content, or authenticated session material. The pull request that proposes a fix is referenced in GitHub Pull Request #344 but has not yet been merged.

Root Cause

The root cause is missing neutralization of user-controlled input before it is inserted into the browser DOM by the renderHistory routine. The function trusts previously stored history entries and renders them as HTML instead of text.

Attack Vector

Exploitation occurs over the network and requires low privileges. A victim must interact with the affected view — for example, opening the Image Studio history panel — for the malicious script to execute. Successful exploitation impacts integrity within the victim's browser context.

No verified public exploit code is available. For technical details, refer to the tracker at GitHub Issue #309 and the third-party record at VulDB CVE-2026-90602.

Detection Methods for CVE-2026-90602

Indicators of Compromise

History entries containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...> stored in Image Studio state or backing storage.
Browser console errors or Content Security Policy (CSP) violations originating from ImageStudio.js when rendering the history view.
Unexpected outbound requests from user browsers to attacker-controlled hosts shortly after opening the Image Studio panel.

Detection Strategies

Perform static review of ImageStudio.js for direct assignments to innerHTML or unsanitized template interpolation within renderHistory.
Deploy runtime DOM monitoring or CSP report-only policies to surface script execution originating from user-controlled history fields.
Scan stored history records in the application's backend for HTML or JavaScript syntax that should not appear in normal user data.

Monitoring Recommendations

Enable and centralize CSP violation reports to identify attempted script injection against Studio Components views.
Log and alert on client-side error telemetry involving the renderHistory function.
Monitor web application access logs for anomalous input submitted to endpoints that persist Image Studio history data.

How to Mitigate CVE-2026-90602

Immediate Actions Required

Restrict access to the affected Open-Generative-AI instance to trusted users until a patched release is available.
Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Purge or sanitize existing Image Studio history entries in backing storage to remove any injected markup.

Patch Information

No official patched release exists at the time of publication. A community-submitted fix is tracked in GitHub Pull Request #344 and awaits maintainer acceptance. Operators should monitor the Open-Generative-AI repository for release notes incorporating the fix.

Workarounds

Modify renderHistory in ImageStudio.js locally to escape output using textContent or an equivalent safe DOM API instead of innerHTML.
Introduce an HTML-sanitization library such as DOMPurify around any user-controlled data rendered by Studio Components.
Deploy a reverse proxy or Web Application Firewall (WAF) rule that filters HTML tags and event-handler attributes from requests writing to history endpoints.

bash

# Example nginx configuration enforcing a restrictive Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;