Stored Cross-Site Scripting in AIL Framework by AIL Project

CVE-2026-100174

What is CVE-2026-100174?

The AIL Framework's tag selector component is vulnerable to stored cross-site scripting (XSS), allowing authenticated users to embed malicious HTML and JavaScript within custom tag names. When these tags are rendered on a page, the malicious content gets executed in the context of any authenticated user viewing the page, which can lead to severe security implications such as session hijacking, unauthorized data access, and further client-side attacks. This exposure occurs due to the improper handling of user-generated content within the application's DOM, highlighting the need for robust sanitization mechanisms.

References