CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting · Briflio