CVE-2026-100172

The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html="true", the content is interpreted as HTML in the victim's browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim's session, potentially enabling data exfiltration or actions with the victim's privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content.

• CWE-79

• https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10012Use after free in Skia in Google Chrome prior to 148.0.7778.…8.3
• CVE-2026-10013Use after free in WebCodecs in Google Chrome prior to 148.0.…8.8
• CVE-2026-10014Use after free in WebMIDI in Google Chrome on Android prior …8.3
• CVE-2026-10015Integer overflow in WTF in Google Chrome prior to 148.0.7778…8.8
• CVE-2026-10016Use after free in DOM in Google Chrome prior to 148.0.7778.2…8.8
• CVE-2026-10017Out of bounds read in Headless in Google Chrome prior to 148…8.3
• CVE-2026-100174The AIL Framework tag selector component (var/www/static/js/…5.1
• CVE-2026-100176The AIL Framework's username timeline feature is vulnerable …8.5
• CVE-2026-100177The AIL Framework crawler task creation API (api_add_crawler…6.3
• CVE-2026-10018Integer overflow in ANGLE in Google Chrome prior to 148.0.77…6.5
• CVE-2026-100187The Onion module in AIL Framework contained a performance sh…6.9
• CVE-2026-10019Integer overflow in ANGLE in Google Chrome prior to 148.0.77…8.8