Read the docs
TI-2026-64573 Aliases CVE-2026-100172GHSA-fg9r-9hmh-7x8c

Cross-site scripting in ail framework

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html="true", the content is interpreted as HTML in the victim's browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim's session, potentially enabling data exfiltration or actions with the victim's privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00266 18th percentileScored 2026-11-07
Fix Fixed ail framework (ail project): 7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ail projectail frameworkbefore 7.17.1Patch availableCNA
  • ail framework Vendorail project Affected before 7.1 Fixed in 7.1 Patch available CNA

Remediation

  • Fix · CNA ail framework (ail project) Fixed in 7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ail framework 7.1

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-64575 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline TooltipPriority LOW 39
    • TI-2026-64579 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain ValidationPriority LOW 37
    • TI-2026-64580 Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain PagePriority LOW 28
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100172
  2. 2026-10-03 Alias added: GHSA-fg9r-9hmh-7x8c

References

Patch 1

  • TI-2026-64575 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip CVSS 4.0HIGH 8.5
  • TI-2026-64579 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation CVSS 4.0MEDIUM 6.9
  • TI-2026-53282 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources CVSS 4.0HIGH 7.1
  • TI-2026-50065 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework CVSS 4.0HIGH 8.2
  • TI-2026-40787 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read CVSS 4.0HIGH 8.3
  • TI-2026-42473 Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read CVSS 4.0HIGH 7.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences