Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90602

Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

CVSS 4.0 5.1 MEDIUMCVSS 3.1 3.5 LOWCVSS 3.0 3.5 LOWCVSS 2.0 4.0 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90602

Published

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90602

Published

Open-Generative-AI

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Anil-matcha",
                    "product": "Open-Generative-AI",
                    "versions": [
                        {
                            "version": "1.0.0",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.1",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.2",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.3",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.4",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.5",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.6",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.7",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.8",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.9",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.10",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.11",
                            "status": "affected"
                        },
                        {
                            "version": "2.0",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:anil-matcha:open-generative-ai:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Studio Components"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON