What is the CVSS score of CVE-2026-12228?

CVE-2026-12228 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of LoLLMs are affected by CVE-2026-12228?

A stored cross-site scripting vulnerability in parisneo/lollms permits authenticated users to inject malicious scripts into other users' direct messages, enabling browser-based account compromise and…

How to fix or mitigate CVE-2026-12228?

Within 24 hours, identify and inventory all parisneo/lollms deployments and user populations at risk. Within 7 days, implement interim mitigations: restrict or disable the POST /api/prompts/share endpoint if non-critical to operations, deploy Web Application Firewall rules to block suspicious prompt_content parameters, enforce strict Content Security Policy headers with no-unsafe-inline, and modify MessageContentRenderer to replace v-html rendering with v-text for all user-supplied content. Within 30 days, monitor parisneo/lollms GitHub releases and vendor advisories for a patched version and prepare immediate deployment when available.

LoLLMs CVE-2026-12228

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-18 @huntr_ai

XSS Parisneo Lollms Parisneo

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (huntr_ai) PRIMARY

HIGH

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

8.7 HIGH

Network-reachable stored XSS needs an authenticated sender (PR:L) and victim interaction opening the DM (UI:R); payload runs in the victim's session, changing scope (S:C) with high confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (huntr_ai).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Aug 19, 2026 - 19:37 NVD

HIGH MEDIUM

CVSS changed

Aug 19, 2026 - 19:37 NVD

8.7 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Jul 18, 2026 - 21:00 vuln.today

CVE Published

Jul 18, 2026 - 20:36 cve.org

HIGH 8.7

DescriptionNVD

A stored cross-site scripting (XSS) vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled prompt_content into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through MessageContentRenderer, which uses v-html to insert rendered HTML into the DOM. The frontend sanitizer, which is regex-based, fails to comprehensively sanitize attacker-controlled HTML, allowing malicious payloads to execute in the victim's browser context. This vulnerability enables any authenticated user to send a malicious prompt-share message to another user's inbox, leading to arbitrary JavaScript execution, authenticated actions as the victim, exposure of same-origin application data, and potential account takeover.

AnalysisAI

Stored cross-site scripting in parisneo/lollms (latest) lets any authenticated user weaponize the POST /api/prompts/share endpoint to plant JavaScript in another user's direct-message inbox. The unsanitized prompt_content is persisted to DBDirectMessage.content and later rendered via v-html by MessageContentRenderer, so when the victim opens the DM thread the payload executes in their browser context, enabling actions-as-victim, same-origin data theft, and potential account takeover. No public exploit identified at time of analysis and no EPSS/KEV signal is provided, but the reproduction path is well-documented in the huntr bounty report.

Technical ContextAI

The affected component is LoLLMs (Lord of Large Language Models), a self-hosted web UI/orchestration platform for running local and remote LLMs. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the server stores attacker-supplied prompt_content verbatim in DBDirectMessage.content with no server-side output encoding or sanitization, and the Vue frontend then injects the message body into the DOM using v-html - a sink that renders raw HTML/script. The only defense is a client-side regex-based sanitizer, which is fundamentally unreliable against HTML because regex cannot correctly model nested/malformed markup, event-handler attributes, or encoding tricks, so crafted payloads bypass it. The CPE cpe:2.3:a:parisneo:parisneo/lollms:*:*:*:*:*:*:*:* indicates all versions up to and including the latest are in scope.

RemediationAI

No vendor-released patch identified at time of analysis, so the primary mitigation is to fix the code: enforce server-side sanitization/output-encoding of prompt_content before it is stored in DBDirectMessage.content, and replace the regex-based client sanitizer with a vetted DOM-based sanitizer such as DOMPurify applied to any content rendered through v-html in MessageContentRenderer (or avoid v-html entirely and render as text). As compensating controls until a fix ships, operators can restrict LoLLMs to trusted users only and disable or gate the prompt-share/DM feature if configurable (trade-off: removes legitimate sharing collaboration), and can deploy a strict Content-Security-Policy that forbids inline script execution (script-src without 'unsafe-inline') to blunt injected payloads (trade-off: may break UI features relying on inline scripts and requires testing). Monitor https://huntr.com/bounties/25623635-5ceb-4062-8289-02089e6d97c1 and the parisneo/lollms repository for the patched release and upgrade as soon as it is available.