EUVD-2026-54305
GHSA-mcpq-xxxj-mc69
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:N because description explicitly states the attacker needs no AIL account; UI:R for mandatory victim interaction; S:C and C:L/I:L for session abuse potential.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Lifecycle Timeline
3DescriptionCVE.org
AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]).
If attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.
Successful exploitation could allow JavaScript to execute in the victim’s browser within the security context of the AIL Framework application. Depending on the victim’s privileges and the application’s protections, the attacker could perform actions using the victim’s session, access information available to the victim, or modify data through authenticated application requests.
The vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user.
AnalysisAI
Reflected cross-site scripting in AIL Framework's /tag/add_tags endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of any authenticated AIL user who opens a specially crafted link. The flaw originates from the error-handling path in tags_ui.py, which returned raw Python string output via str(res[0]) directly as an HTML response without output encoding, permitting attacker-controlled content to be reflected and rendered by the victim's browser. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix has been committed to the GitHub repository.
Technical ContextAI
AIL Framework is an open-source modular analysis platform used by CERTs and threat intelligence teams to process and analyze information leaks. The vulnerability resides in var/www/blueprints/tags_ui.py within the Flask blueprint handling the /tag/add_tags route. When a tag operation fails, the error branch executed return str(res[0]), serializing the Python object to a raw string and returning it as an HTTP response with an HTML content type, bypassing any output encoding. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class: attacker-influenced data present in the error result was rendered by the browser as executable markup. The upstream commit 4faf5117b15b4a6208d56f8c54f51c58b87eb007 replaces the unsafe return with return jsonify(res[0]), which emits a JSON content type that browsers do not interpret as HTML, eliminating the reflection vector. No CPE strings were provided in the source data.
RemediationAI
Apply the upstream fix by updating AIL Framework to a version that incorporates commit 4faf5117b15b4a6208d56f8c54f51c58b87eb007 from https://github.com/ail-project/ail-framework/commit/4faf5117b15b4a6208d56f8c54f51c58b87eb007. The specific tagged release containing this commit is not confirmed in the available data - operators should verify with the ail-project release history or pull directly from the patched main branch. As an immediate compensating control while patching is coordinated, consider restricting access to the /tag/add_tags endpoint via network-layer controls (e.g., reverse proxy ACLs) to limit exposure to trusted internal networks only; this reduces but does not eliminate risk if internal users can be socially engineered. Educating AIL users about phishing and suspicious links targeting the application is a low-cost supplemental measure given that exploitation requires the victim to open a crafted URL.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today