Stored XSS Vulnerability in Lollms Affecting Parisneo's Social Feature

CVE-2026-1115

What is CVE-2026-1115?

A Stored Cross-Site Scripting vulnerability exists in the social feature of Lollms. The issue arises from the create_post function, where user-generated content is assigned to the DBPost model without proper sanitization. This flaw permits attackers to inject and store malicious JavaScript, which can be executed in the browsers of users, including administrators, when they view the Home Feed. The implications include potential account takeovers, session hijacking, and propagation of attacks. The vulnerability has been patched in version 2.2.0, making it crucial for users to update their installations.

References