Read the docs
TI-2026-64575 Aliases CVE-2026-100176GHSA-gr26-vj67-v262

Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames into the DOM using D3's html() method in the tooltip. Because the username value (d.obj) is interpolated directly into an HTML string without sanitization, a crafted username containing HTML event handlers (e.g., <img src=x onerror=alert(1)>) will execute arbitrary JavaScript in the analyst's browser when the analyst hovers over the corresponding timeline entry. The attack requires the victim to be an authenticated analyst with access to the timeline view and to interact with the malicious timeline entry (hover). Successful exploitation can lead to session hijacking, data exfiltration, or unauthorized actions performed within the analyst's authenticated session. The vulnerability resides in the client-side JavaScript file var/www/static/js/d3/timeline_basic.js.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00354 29th percentileScored 2026-11-07
Fix Fixed ail framework (ail project): 7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ail projectail frameworkbefore 7.17.1Patch availableCNA
  • ail framework Vendorail project Affected before 7.1 Fixed in 7.1 Patch available CNA

Remediation

  • Fix · CNA ail framework (ail project) Fixed in 7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ail framework 7.1

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-64573 Cross-site scripting in ail frameworkPriority LOW 38
    • TI-2026-64579 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain ValidationPriority LOW 37
    • TI-2026-64580 Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain PagePriority LOW 28
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100176
  2. 2026-10-03 Alias added: GHSA-gr26-vj67-v262

References

Patch 1

  • TI-2026-64573 Cross-site scripting in ail framework CVSS 4.0HIGH 8.5
  • TI-2026-64579 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation CVSS 4.0MEDIUM 6.9
  • TI-2026-53282 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources CVSS 4.0HIGH 7.1
  • TI-2026-50065 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework CVSS 4.0HIGH 8.2
  • TI-2026-40787 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read CVSS 4.0HIGH 8.3
  • TI-2026-42473 Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read CVSS 4.0HIGH 7.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences