AIL Framework CVE-2026-100174

Requires a multi-user AIL Framework deployment where the attacker holds an authenticated account with permission to create custom tags (PR:L) - this is the primary gating condition and is not available to anonymous users. Exploitation is stored/persistent: the payload fires when any other authenticated user (UI:P, passive) simply loads a page that renders the tag selector containing the malicious tag, with no further victim action. Limiting factors: attacker must have tag-creation rights (insider or compromised account), the target must be a logged-in AIL user viewing the affected UI, and unpatched code prior to commit b2d0ed05 must be running. Impact is confined to the application origin (client-side script execution), not direct server compromise.

This is a genuine but moderate-severity stored XSS (CWE-79) in the AIL Framework tag selector. The provided CVSS 4.0 vector (5.1) and its metrics are internally consistent with the description: AV:N (web app), AC:L, PR:L (attacker needs an authenticated account with tag-creation rights), UI:P (victim passively loads a page), and low confidentiality/integrity impact on both the vulnerable and subsequent (browser) systems, no availability impact. No EPSS score, no CISA KEV listing, and no public exploit code were provided - so this is no public exploit identified at time of analysis. The realistic risk is bounded by three factors that keep it below its raw CVSS: (1) the attacker must already be an authenticated, tag-creating user (insider or compromised low-priv account), (2) the impact is client-side script execution in-origin rather than direct server compromise, and (3) AIL is a niche multi-user CTI tool, not internet-facing mass-deployed software. The patch is confirmed available (vendor commit b2d0ed05). Net: a real, patchable issue worth prioritizing in multi-user AIL deployments, but not an urgent internet-wide emergency - treat as a privilege-escalation/lateral-movement risk within an already-authenticated analyst team rather than a pre-auth RCE.

A low-privileged AIL analyst (or attacker using a stolen analyst account) with permission to create custom tags creates a tag whose name embeds a payload such as '<img src=x onerror=...>' or '<svg onload=...>'. When a higher-privileged analyst later opens any page that renders the tag selector containing that tag, the stored payload is injected via jQuery's html property and executes in the victim's browser session. No public exploit code was provided, but the payload is trivial to craft.