Vulnerabilities

TI-2026-64580 CVE-2026-100190 · GHSA-rpj3-jvgh-5qrf

Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page

LOW 28

The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS).

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00316 Published 2026-09-25 Fixed in 7.1 CWE-79

TI-2026-64579 CVE-2026-100187 · GHSA-8f5g-55q8-r2c9

AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation

LOW 37

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00433 Published 2026-09-25 Fixed in 7.1 CWE-20

TI-2026-64576 CVE-2026-100177 · GHSA-7p6q-w6xc-4m6h

Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment

LOW 28

The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00341 Published 2026-09-25 Fixed in 7.1 CWE-20

TI-2026-64575 CVE-2026-100176 · GHSA-gr26-vj67-v262

Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

LOW 39

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS).

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00354 Published 2026-09-25 Fixed in 7.1 CWE-79

TI-2026-64574 CVE-2026-100174 · GHSA-rm3v-pc8w-cwxj

Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

LOW 23

The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS).

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00399 Published 2026-09-25 Fixed in 7.1 CWE-79

TI-2026-64573 CVE-2026-100172 · GHSA-fg9r-9hmh-7x8c

Cross-site scripting in ail framework

LOW 38

The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explo…

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00266 Published 2026-09-25 Fixed in 7.1 CWE-79