Stored Cross-Site Scripting Vulnerability in AIL Framework by AIL Project

CVE-2026-71446

What is CVE-2026-71446?

The AIL Framework contains a stored cross-site scripting (XSS) vulnerability that allows an attacker to manipulate crawled URLs. These URLs are inserted into JavaScript onclick handlers without proper encoding, which can lead to the execution of arbitrary JavaScript code in the browser of an authenticated user. When an analyst views a previously stored screenshot associated with a malicious URL, the attacker's code can execute within the context of the user's session, potentially compromising sensitive information or allowing unauthorized actions. This vulnerability was mitigated by securing the URL handling process using Jinja's tojson filter, ensuring safe character escaping.

References