CVE-2026-39416CWE-79

Stored XSS in modal item preview for long item content in AIL Framework

High · published April 8, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in 6.8.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Amber
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-08T20:11Z
EPSS history
Timeline
  • 08 APR 20:11Z
    Stored XSS in modal item preview for long item content in AIL Framework
    cvelistv5