CVE-2026-91921Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform
Updated under an hour ago ()
Does this affect you?
It affects 1millionbot AI Chatbot Platform (SaaS) de 1millionbot.. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax and certain unsanitised content blocks. The impact is limited to the user’s own interactive session; no compromise of internal infrastructure, access to third-party data or impact on administrative panels has been identified.
- CVSS
- 5.1 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- INCIBE
- NVD analysis
- Deferred
- Record last updated
- Sep 21, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
1millionbot AI Chatbot Platform (SaaS) de 1millionbot. 1millionbot:ai_chatbot_platform_saas_de_1millionbot (from the name) | Version prior to CVE publication | CNA record |
References
- https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-1millionbots-ai-chatbot-platformpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.