aidlc-traceability CVE-2026-120497

Requires an actor able to modify the project's AI-DLC artifact files - specifically the artifact title or description fields - or able to supply an untrusted project whose artifacts the victim imports; the attacker injects a '</script>' closing sequence plus script content. Triggering additionally requires that a user generate the HTML (not Markdown) traceability report with an unpatched aidlc-traceability CLI (before commit 96cf0ea) and then open that report in a browser. Limiting factors: exploitation is local (AV:L) and demands active user interaction (opening the report); only the HTML output path is affected, so the Markdown report output is a safe alternative; AI mode and AWS credentials are explicitly NOT required to trigger it; and the injected script's reach is confined to the report context - it can rewrite displayed coverage/gap-analysis results and read the report's contents including the victim's local file paths, but cannot access other local files or credentials.

This is a genuinely low-to-moderate real-world risk despite being a stored XSS. The vendor CVSS 4.0 base score is 4.6 (Medium) with AV:L (local), AC:L, AT:N, PR:N, UI:A (the victim must actively open the generated report), and impact confined to the subsequent system (the browser) at SC:L/SI:L with no vulnerable-system impact (VC:N/VI:N/VA:N). No EPSS score is provided in the input, and the CVE is not listed in CISA KEV; there is no claim of active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-on-normal-cadence item rather than an emergency. A detailed, step-by-step proof-of-concept is published inside the AWS GHSA advisory, so exploitation is well understood, but this is a documented reproduction rather than a signal of in-the-wild use - do not conflate the two. One tension worth flagging: the vendor scored PR:N, yet exploitation requires an actor who can modify the project's artifact files (or supply an untrusted project the victim imports); the 'no privileges' rating only holds in the untrusted-project scenario where the attacker authors the malicious artifacts freely. Overall this is a high-CVSS-class bug class (XSS) but a low-real-priority issue: the affected product is an obscure, now-removed CLI, the vector is local, user interaction is mandatory, and injected script cannot reach other local files or AWS credentials.

An actor who can modify a project's AI-DLC artifact files (for example by contributing or supplying an untrusted project) embeds a '</script>' breakout sequence followed by script content in an artifact title or description. When a developer runs an unpatched aidlc-traceability CLI (before commit 96cf0ea) to generate an HTML traceability report and opens it in a browser, the embedded artifact-data JSON terminates the surrounding <script> block early and the injected script executes in the report's context. A step-by-step public PoC description is published in the GHSA advisory; because AV:L and UI:A, the attacker still depends on the victim generating and opening the HTML report locally.