CVE-2026-1116
Cross-site Scripting in parisneo/lollms `from_dict` Enables Account Hijack
Publication date: 2026-04-12
Last updated on: 2026-04-17
Assigner: huntr.dev
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lollms | lollms | to 2.1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-site Scripting (XSS) issue found in the `from_dict` method of the `AppLollmsMessage` class in the parisneo/lollms software before version 2.2.0.
It occurs because the `content` field is not properly sanitized or HTML encoded when user-provided data is deserialized. This allows attackers to inject malicious HTML or JavaScript code.
When executed in another user's browser, this malicious code can perform harmful actions such as stealing session information or taking over user accounts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Cross-site Scripting (XSS) issue that allows attackers to inject malicious scripts, potentially leading to account takeover and session hijacking.
Such security weaknesses can impact compliance with standards like GDPR and HIPAA because they may lead to unauthorized access to personal or sensitive data, violating data protection and privacy requirements.
However, the provided information does not explicitly describe the direct effects on compliance with these regulations.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to serious security impacts including account takeover and session hijacking.
Additionally, the vulnerability is wormable, meaning it can propagate itself from one user to another, potentially causing widespread compromise.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade parisneo/lollms to version 2.2.0 or later, where the issue in the from_dict method of the AppLollmsMessage class has been fixed by properly sanitizing or HTML encoding the content field.