Read the docs
TI-2026-00843 Aliases CVE-2026-1115GHSA-8wrq-fv5f-pfp2

Stored XSS in parisneo/lollms

Priority HIGH 76CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the `create_post` function within `backend/routers/social/__init__.py`, where user-provided content is directly assigned to the `DBPost` model without sanitization. This allows attackers to inject and store malicious JavaScript, which is executed in the browsers of users viewing the Home Feed, including administrators. This can lead to account takeover, session hijacking, and wormable attacks. The issue is resolved in version 2.2.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01261 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed parisneo/lollms (parisneo): 2.2.0lollms (PyPI): 2.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
parisneoparisneo/lollmsbefore 2.2.02.2.0Patch availableCNA
—lollms (PyPI)before 2.2.02.2.0Patch availableGHSA-8wrq-fv5f-pfp2
  • parisneo/lollms Vendorparisneo Affected before 2.2.0 Fixed in 2.2.0 Patch available CNA
  • lollms (PyPI) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-8wrq-fv5f-pfp2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:*up to 2.1.0VulnerableLollms
  • cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:* Versions up to 2.1.0 Vulnerable ·Lollms

Remediation

  • Fix · CNA parisneo/lollms (parisneo) Fixed in 2.2.0
  • Fix · GHSA-8wrq-fv5f-pfp2 lollms (PyPI) Fixed in 2.2.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1115
  2. 2026-10-03 Alias added: GHSA-8wrq-fv5f-pfp2

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-00842 Improper Access Control via Weak JWT Token in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-05059 Remote Code Execution via Path Traversal in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-04029 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui CVSS 3.0CRITICAL 9.8
  • TI-2024-04023 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui CVSS 3.1CRITICAL 9.8
  • TI-2024-03798 Arbitrary Code Execution in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-02196 Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui CVSS 3.0CRITICAL 9.6
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences