Aidlc Traceability
Monthly
Stored cross-site scripting in the aidlc-traceability CLI (versions from 0.1.0 up to, but not including, commit 96cf0ea) lets an actor who can modify a project's AI-DLC artifact files place a closing script-tag sequence plus script content in an artifact title or description, which then executes in the browser of a user who generates the HTML traceability report and opens it. The injected script can rewrite the displayed coverage and gap-analysis results and read the report's contents, including the victim's local file paths, but cannot reach other local files or credentials. The flaw is fixed at commit 96cf0ea (2026-07-03); a public proof-of-concept reference exists in the GitHub advisory and is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV entry).
Stored cross-site scripting in the aidlc-traceability CLI (versions from 0.1.0 up to, but not including, commit 96cf0ea) lets an actor who can modify a project's AI-DLC artifact files place a closing script-tag sequence plus script content in an artifact title or description, which then executes in the browser of a user who generates the HTML traceability report and opens it. The injected script can rewrite the displayed coverage and gap-analysis results and read the report's contents, including the victim's local file paths, but cannot reach other local files or credentials. The flaw is fixed at commit 96cf0ea (2026-07-03); a public proof-of-concept reference exists in the GitHub advisory and is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV entry).