Cross-site Scripting Vulnerability in AppLollmsMessage Class by Parisneo

CVE-2026-1116

What is CVE-2026-1116?

A vulnerability exists in the from_dict method of the AppLollmsMessage class in the lollms product. It stems from inadequate sanitization or HTML encoding of the content field during the deserialization of user-supplied data. This weakness allows attackers to inject malicious HTML or JavaScript, enabling them to execute payloads in the context of another user's browser. Potential exploitation can result in severe consequences, including account takeovers, session hijacking, and even wormable attacks.

References