CVE-2026-100187

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in ".onion"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in ".onion" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler's task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler's target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services.

• CWE-20

• https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10018Integer overflow in ANGLE in Google Chrome prior to 148.0.77…6.5
• CVE-2026-100180The Jeg Kit for Elementor – Powerful Addons for Elementor, W…5.4
• CVE-2026-100182The Download Monitor plugin for WordPress is vulnerable to S…7.2
• CVE-2026-100184The Calculated Fields Form – AI Form Builder for WordPress –…4.7
• CVE-2026-100185The Directorist: AI-Powered Business Directory, Listings & C…6.4
• CVE-2026-100186The User Profile Builder – Beautiful User Registration Forms…7.2
• CVE-2026-10019Integer overflow in ANGLE in Google Chrome prior to 148.0.77…8.8
• CVE-2026-100190The AIL Framework crawler splash domain page (showDomain.htm…6.3
• CVE-2026-100192X-SpringBoot through 6.0 exposes appKey and appSecret creden…6.5
• CVE-2026-100193The Tutor LMS – eLearning and online course solution plugin …4.7
• CVE-2026-100196The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes …7.2
• CVE-2026-100197Rejected reason: This CVE ID has been rejected or withdrawn …