CVE-2026-100187
Deferred Deferred - Pending Action

Onion Domain Validation Bypass in AIL Framework

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: CIRCL

Description
The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in ".onion"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in ".onion" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler's task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler's target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-16
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-100187
EUVD
EUVD-2026-87093

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ail_project ail_framework to 5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Onion module in AIL Framework incorrectly validating URLs as legitimate .onion targets. It only checked for a 69-character length and a '.onion' suffix without proper hostname parsing. Attackers could exploit this by embedding crafted URLs with non-onion domains that met these criteria, tricking the framework into processing them as valid .onion URLs.

Detection Guidance

To detect this vulnerability, inspect the AIL Framework's crawler task queue for URLs ending in .onion that do not conform to valid .onion domain standards. Check logs for URLs with IP addresses or non-onion hostnames followed by .onion. Review the framework's URL extraction logic for improper hostname parsing.

Impact Analysis

This vulnerability allows unauthenticated attackers to inject arbitrary non-onion targets into the crawler's task queue. This could lead to the framework processing unintended network resources, potentially causing resource exhaustion, data leaks, or misdirection of crawler activity away from legitimate .onion services.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it pertains to the integrity of a crawler's target selection in a specific framework. The issue involves unauthorized injection of non-onion targets into a crawler's queue, which may affect data processing integrity but does not inherently violate privacy or security requirements outlined in these regulations.

Mitigation Strategies

Update the AIL Framework to a patched version that performs proper hostname parsing and onion-domain validation. Remove any non-onion URLs from the crawler task queue. Implement stricter input validation for URLs processed by the framework to prevent injection of arbitrary targets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart