Stored Cross-Site Scripting in AIL Framework Crawler by AIL Project
CVE-2026-100190

6.3MEDIUM

Key Information:

Vendor

Ail Project

Status
Ail Framework
Vendor
CVE Published:
25 September 2026

What is CVE-2026-100190?

The AIL Framework crawler splash domain page (showDomain.html) contains a stored cross-site scripting vulnerability that arises from improperly handling user-supplied data. Specifically, data from imported crawler captures, including item IDs, URLs, and screenshot paths, are directly inserted into inline JavaScript contexts. This process results in JavaScript payloads being executed when the affected page is accessed, allowing attackers to hijack user sessions, exfiltrate sensitive data, or execute actions on behalf of users without their consent. As the vulnerability persists in the application's data layer, it is triggered simply by rendering the affected domain page, endangering both regular and privileged users alike. Immediate action is recommended to patch this security concern.

Affected Version(s)

ail framework < 7.1

References

https://github.com/ail-project/ail-framework/commit/31376...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aurelien Thirion
Jeroen Pinoy
.