Reflected Cross-Site Scripting Vulnerability in AIL Framework by AIL Project

CVE-2026-71445

What is CVE-2026-71445?

The AIL Framework has a reflected cross-site scripting vulnerability located in the /tag/add_tags endpoint. When errors occur during tag operations, the application improperly returns the error message directly as HTML. This flaw allows attacker-controlled input to be reflected back to the victim, leading to the execution of arbitrary JavaScript in their browser. By tricking an authenticated user into clicking a specially crafted link, an attacker can leverage this vulnerability to perform actions that could compromise the victim's session, access their data, or manipulate application information. User interaction is required for exploitation, as the victim must open the malicious request, making awareness of this vulnerability crucial for AIL Framework users.

References