CVE-2026-39416

AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in 6.8.

• CWE-79

• https://github.com/ail-project/ail-framework/security/advisories/GHSA-fj6v-43r7-gcjmVendor Advisory
• https://vulnerability.circl.lu/vuln/gcve-1-2026-0023Third Party Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39410Hono is a Web application framework that provides support fo…4.8
• CVE-2026-39411LobeHub is a work-and-lifestyle space to find, build, and co…7.1
• CVE-2026-39412LiquidJS is a Shopify / GitHub Pages compatible template eng…7.5
• CVE-2026-39413LightRAG provides simple and fast retrieval-augmented genera…6.5
• CVE-2026-39414MinIO is a high-performance object storage system. From RELE…6.5
• CVE-2026-39415Frappe Learning Management System (LMS) is a learning system…4.3
• CVE-2026-39417MaxKB is an open-source AI assistant for enterprise. Version…5.5
• CVE-2026-39418MaxKB is an open-source AI assistant for enterprise. In vers…7.4
• CVE-2026-39419MaxKB is an open-source AI assistant for enterprise. In vers…3.1
• CVE-2026-3942Incorrect security UI in PictureInPicture in Google Chrome p…4.3
• CVE-2026-39420MaxKB is an open-source AI assistant for enterprise. In vers…7.4
• CVE-2026-39421MaxKB is an open-source AI assistant for enterprise. Version…7.4