Read the docs
TI-2026-64579 Aliases CVE-2026-100187GHSA-8f5g-55q8-r2c9

AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation

Priority LOW 37CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in ".onion"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in ".onion" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler's task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler's target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Fix Fixed ail framework (ail project): 7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ail projectail frameworkbefore 7.17.1Patch availableCNA
  • ail framework Vendorail project Affected before 7.1 Fixed in 7.1 Patch available CNA

Remediation

  • Fix · CNA ail framework (ail project) Fixed in 7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ail framework 7.1

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-64575 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline TooltipPriority LOW 39
    • TI-2026-64573 Cross-site scripting in ail frameworkPriority LOW 38
    • TI-2026-64580 Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain PagePriority LOW 28
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100187
  2. 2026-10-03 Alias added: GHSA-8f5g-55q8-r2c9

References

Patch 1

  • TI-2026-64575 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip CVSS 4.0HIGH 8.5
  • TI-2026-64573 Cross-site scripting in ail framework CVSS 4.0HIGH 8.5
  • TI-2026-53282 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources CVSS 4.0HIGH 7.1
  • TI-2026-50065 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework CVSS 4.0HIGH 8.2
  • TI-2026-40787 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read CVSS 4.0HIGH 8.3
  • TI-2026-42473 Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read CVSS 4.0HIGH 7.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences