CVE-2026-71446

Received Received - Intake

Stored XSS in AIL Framework Domain View

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be recorded in the crawler history can inject JavaScript syntax into the stored URL value. The payload remains stored by AIL and is subsequently included in the domain view. When an authenticated analyst clicks the screenshot icon associated with the malicious URL, the injected JavaScript executes in the analyst’s browser within the security context of the AIL Framework application. Successful exploitation could allow an attacker to access information available to the analyst’s session, modify displayed content, or perform application actions using the analyst’s privileges. Exploitation requires the victim to interact with the affected screenshot entry. The vulnerability was corrected by serializing the crawled URL with Jinja’s tojson filter before inserting it into the JavaScript handler. This safely escapes characters that could otherwise terminate the JavaScript string and introduce executable code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71446

Affected Vendors & Products

Vendor	Product	Version / Range
ail_framework	ail_framework	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

AIL Framework has a stored cross-site scripting (XSS) vulnerability in the crawler domain view. Crawled URLs are embedded directly into a JavaScript onclick handler without proper encoding. An attacker can inject malicious JavaScript by storing a specially crafted URL in the crawler history. When an analyst views the domain and clicks the screenshot icon for the malicious URL, the injected script executes in the analyst's browser within the AIL Framework's security context.

Detection Guidance

To detect this vulnerability, inspect AIL Framework logs for suspicious URLs in the crawler domain view. Look for URLs containing JavaScript code or unusual characters in screenshot entries. Check for stored XSS payloads in the crawler history by reviewing the database or application logs.

Impact Analysis

This vulnerability allows an attacker to access sensitive information available to the analyst's session, modify displayed content, or perform actions using the analyst's privileges. Exploitation requires the victim to interact with the affected screenshot entry, meaning clicking the malicious URL is necessary for the attack to succeed.

Mitigation Strategies

Update AIL Framework to the latest version where the issue is fixed by serializing URLs with Jinja’s tojson filter. If immediate update is not possible, restrict access to the crawler domain view and monitor for suspicious activity. Remove any malicious URLs from the crawler history.

Hi! I’m here to help you understand CVE-2026-71446. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70