EUVD-2026-87093
GHSA-8f5g-55q8-r2c9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPublish crafted 69-char '.onion'-suffixed URL in crawled source
-
ExploitAIL Onion module extracts via length/suffix shortcut
-
ExecutionBogus domain sliced and queued as onion task
-
ImpactCrawler fetches attacker-chosen non-onion target
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires only that the attacker can place crafted content in a source that the AIL Framework's crawler is configured to ingest (e.g., a monitored paste/leak/web source), and the payload must be a URL that is EXACTLY 69 characters long and ends in '.onion' to satisfy the vulnerable perf shortcut in the Onion module. No authentication, no user interaction, and default configuration are sufficient (PR:N/UI:N). Limiting factors: the target instance must actually run an affected (unpatched) AIL Framework version and be crawling a source the attacker can influence; impact is confined to crawler target selection integrity, not host compromise, so realistic risk is contained to poisoning the analysis pipeline. |
| Impact | This is a moderate-integrity issue, not a high-priority emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, but the impact is deliberately scoped to VI:L (low integrity) with VC:N/VA:N - no confidentiality or availability loss. The commit diff corroborates the description exactly: the removed 'perf' shortcut (len==69 and endswith '.onion') is a genuine input-validation gap (CWE-20), so the technical claim is well-founded. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code, so exploitation is theoretical at this time. The realistic worst case is crawler task-queue poisoning / target redirection (an SSRF-adjacent behavior the description hints at with 'unintended network resources'), but the vendor did not rate any confidentiality or scope-change impact, so it should be treated as a data-integrity defect in an internal analysis tool rather than a server-compromise vector. Net: real but low urgency - patch on normal cycle. |
| Exploit ScenarioDerived | An attacker posts crafted content (e.g., on a paste site, forum, or leak source that an AIL instance crawls) containing a URL exactly 69 characters long that ends in '.onion' but actually points to an IP address or ordinary hostname with a '.onion' path segment. When AIL's Onion module ingests it, the naive length/suffix shortcut slices out a bogus 'domain' and queues it as a legitimate onion crawler task, steering the crawler toward an attacker-chosen resource. No public exploit code exists, but the length/suffix trick is trivial to reproduce from the description and patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Crafted URL injection in the Onion module of the AIL Framework lets unauthenticated content publishers push arbitrary non-onion addresses into the crawler's task queue, degrading the integrity of the framework's target selection. The module used a performance shortcut that accepted any URL of exactly 69 characters ending in '.onion' as a valid onion target, then sliced the domain directly out of the string without proper hostname parsing, so an attacker who can place content in a source the crawler ingests (a monitored paste, leak site, or web feed) can steer the crawler toward unintended network resources. No authentication or user interaction is needed and default configuration is sufficient; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms impact limited to low integrity with no confidentiality or availability effect, and there is no public exploit identified at time of analysis.
RemediationAI
Apply the vendor fix by updating to a revision that includes commit 5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb (https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb), which replaces the 69-character length/suffix shortcut with crawlers.get_url_domain() plus crawlers.is_valid_onion_domain() validation; a released tagged version is not independently confirmed, so verify the deployed commit hash after upgrading. If immediate patching is not possible, reduce exposure by limiting crawling to trusted, non-attacker-influenceable sources and by adding a pre-queue validation filter that parses URLs with a real host component and rejects any 'onion task' whose hostname is an IP literal or non-onion domain - the trade-off is added processing overhead and possible false rejections of legitimate v3 onion addresses if the filter is too broad. Additional compensating controls include monitoring the onion task queue for entries resolving to IP addresses or clearnet hostnames (detects successful poisoning, with the cost of extra logging/alerting) and disabling or sandboxing the Onion crawler module until the fix is applied, which removes the feature entirely for that period. Note that because no authentication is required, network- or credential-based restrictions do not mitigate this issue; validation at the URL-parsing layer is the effective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic improper input validation issue (CWE-20) introduced as an optimization in bin/modules/Onion.py. Rather than resolving the host portion of a candidate URL and validating it against onion-domain rules, the code path checked only len(url) == 69 and url.endswith('.onion'), then derived the domain with a positional slice (url[7:]) - a 'perf' shortcut that assumes the fixed 7-character 'http://' prefix and a fixed 56-character v3 onion address. Because the length and suffix checks operate on the whole URL string rather than the parsed hostname, any URL whose host is an IP address or ordinary hostname can satisfy them as long as a path segment ending in '.onion' pads the string to exactly 69 characters. The extracted hostname is then handed to the Onion crawler as a legitimate task, meaning validation is bypassed at the extraction stage and the framework acts on a non-onion target. The patched logic removes the shortcut entirely and instead calls crawlers.get_url_domain(url) followed by crawlers.is_valid_onion_domain(domain), restoring hostname-aware parsing and proper onion-domain validation. The CPE cpe:2.3:a:ail_project:ail_framework:*:*:*:*:*:*:*:* indicates all listed AIL Framework versions are in scope for this code path.
Know when Ail Framework gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated content injection with no interaction (AV:N/AC:L/PR:N/UI:N); only crawler target-selection integrity is affected (I:L), with no confidentiality or availability impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
DescriptionCVE.org
The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in ".onion"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in ".onion" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler's task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler's target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Ail Framework
View allStored cross-site scripting in AIL Framework <6.8 allows authenticated high-privilege attackers to inject malicious Java
Stored cross-site scripting in the AIL Framework's username timeline lets a remote, unauthenticated attacker execute arb
Stored cross-site scripting in AIL Framework allows an authenticated attacker who can influence matched, tracked, or tag
Authenticated path traversal in AIL Framework (CIRCL's Analysis Information Leak threat-intel platform) lets a low-privi
Global.py in AIL framework 2.8 allows path traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
Path traversal in AIL Framework's PDF object handling lets an authenticated user read files outside the intended PDF sto
Non-blind SSRF in AIL Framework's crawler submission interface allows low-privileged authenticated users to pivot throug
Stored cross-site scripting (XSS) in the AIL Framework crawler splash domain page allows an authenticated user-role API
Cross-tenant authorization bypass in the AIL Framework crawler task API (api_add_crawler_task) lets an authenticated use
Path traversal in AIL Framework's `/objects/item/diff` endpoint exposes gzip-compressed server-side files to authenticat
Stored cross-site scripting (XSS) in the AIL Framework tag selector (var/www/static/js/tags.js) allows an authenticated
Unlimited OTP brute-force against AIL Framework's two-factor authentication endpoint allows an attacker who already poss
Exploit-DB