CVE-2026-100172
Deferred Deferred - Pending Action

Stored XSS in AIL Framework via Popover Data Attributes

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: CIRCL

Description
The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html="true", the content is interpreted as HTML in the victim's browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim's session, potentially enabling data exfiltration or actions with the victim's privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-16
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-100172
EUVD
EUVD-2026-87064

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ail-project ail-framework *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the AIL Framework. It exists in two Jinja2 templates that render popovers for content. Dynamic values like icon color, name, or description are inserted into HTML attributes without proper encoding. When popovers are displayed with data-html=true, the injected content executes as HTML/JavaScript in the victim's browser.

Detection Guidance

To detect this stored XSS vulnerability in the AIL Framework, inspect the Jinja2 templates var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html for direct interpolation of dynamic values into the data-content attribute of Bootstrap popovers without output encoding. Check if popovers are configured with data-html="true". Look for user-controlled input in fields like icon color, icon style, icon glyph, subtype, identifier, name, description, or matched value.

Impact Analysis

An authenticated attacker could inject malicious scripts into content you view. When you display the affected popover, the script may run in your session, potentially stealing data or performing actions on your behalf. This could lead to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. The stored XSS could enable attackers to exfiltrate sensitive data, potentially resulting in non-compliance with these regulations.

Mitigation Strategies

Update the AIL Framework to the latest version where the Jinja2 templates are patched to properly encode dynamic values in the data-content attribute. Ensure all user-controlled inputs in matched, tracked, or tagged content are sanitized before rendering in popovers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100172. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart