CVE-2026-71447 (GCVE-0-2026-71447)
Vulnerability from cvelistv5
Published
2026-08-06 17:04
Modified
2026-08-07 13:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Summary
AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.
The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:
onclick="translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)"
and:
onclick="translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)"
These values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.
Because the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.
Successful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim’s browser under the security origin of the AIL instance.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ail-project | ail-framework |
Version: 0 ≤ 7.0.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T13:56:25.186159Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T13:56:39.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ail-framework",
"repo": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45",
"vendor": "ail-project",
"versions": [
{
"lessThanOrEqual": "7.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Aurelien Thirion"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\u003c/p\u003e\u003cp\u003eThe affected templates inserted message and post identifiers directly into inline JavaScript \u003ccode\u003eonclick\u003c/code\u003e handlers:\u003c/p\u003e\u003cpre\u003e\u003ccode\u003eonclick=\"translateMessageToPreferredLanguage(\u0027{{ message[\u0027id\u0027] }}\u0027, \u0027{{ mess_id_escape }}\u0027, this)\"\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eand:\u003c/p\u003e\u003cpre\u003e\u003ccode\u003eonclick=\"translatePostToPreferredLanguage(\u0027{{ post[\u0027id\u0027] }}\u0027, \u0027{{ post_id_escape }}\u0027, this)\"\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\u003c/p\u003e\u003cp\u003eBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\u003c/p\u003e\u003cp\u003eSuccessful exploitation requires the victim to click the affected \u003cstrong\u003eTranslate to preferred language\u003c/strong\u003e button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\n\nThe affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:\n\nonclick=\"translateMessageToPreferredLanguage(\u0027{{ message[\u0027id\u0027] }}\u0027, \u0027{{ mess_id_escape }}\u0027, this)\"\n\nand:\n\nonclick=\"translatePostToPreferredLanguage(\u0027{{ post[\u0027id\u0027] }}\u0027, \u0027{{ post_id_escape }}\u0027, this)\"\n\nThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\n\nBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\n\nSuccessful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance."
}
],
"impacts": [
{
"capecId": "CAPEC-243",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-243 XSS Targeting HTML Attributes"
}
]
},
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T17:08:52.223Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-71447",
"datePublished": "2026-08-06T17:04:53.694Z",
"dateReserved": "2026-08-06T17:04:47.831Z",
"dateUpdated": "2026-08-07T13:56:39.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-71447\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-07T13:56:25.186159Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-07T13:56:31.933Z\"}}], \"cna\": {\"title\": \"Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jeroen Pinoy\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Aurelien Thirion\"}], \"impacts\": [{\"capecId\": \"CAPEC-243\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-243 XSS Targeting HTML Attributes\"}]}, {\"capecId\": \"CAPEC-592\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-592 Stored XSS\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 6.9, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45\", \"vendor\": \"ail-project\", \"product\": \"ail-framework\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\\n\\nThe affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:\\n\\nonclick=\\\"translateMessageToPreferredLanguage(\u0027{{ message[\u0027id\u0027] }}\u0027, \u0027{{ mess_id_escape }}\u0027, this)\\\"\\n\\nand:\\n\\nonclick=\\\"translatePostToPreferredLanguage(\u0027{{ post[\u0027id\u0027] }}\u0027, \u0027{{ post_id_escape }}\u0027, this)\\\"\\n\\nThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\\n\\nBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\\n\\nSuccessful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim\\u2019s browser under the security origin of the AIL instance.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\u003c/p\u003e\u003cp\u003eThe affected templates inserted message and post identifiers directly into inline JavaScript \u003ccode\u003eonclick\u003c/code\u003e handlers:\u003c/p\u003e\u003cpre\u003e\u003ccode\u003eonclick=\\\"translateMessageToPreferredLanguage(\u0027{{ message[\u0027id\u0027] }}\u0027, \u0027{{ mess_id_escape }}\u0027, this)\\\"\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eand:\u003c/p\u003e\u003cpre\u003e\u003ccode\u003eonclick=\\\"translatePostToPreferredLanguage(\u0027{{ post[\u0027id\u0027] }}\u0027, \u0027{{ post_id_escape }}\u0027, this)\\\"\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\u003c/p\u003e\u003cp\u003eBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\u003c/p\u003e\u003cp\u003eSuccessful exploitation requires the victim to click the affected \u003cstrong\u003eTranslate to preferred language\u003c/strong\u003e button. The injected code would then execute in the victim\\u2019s browser under the security origin of the AIL instance.\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"shortName\": \"CIRCL\", \"dateUpdated\": \"2026-08-06T17:08:52.223Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-71447\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-07T13:56:39.535Z\", \"dateReserved\": \"2026-08-06T17:04:47.831Z\", \"assignerOrgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"datePublished\": \"2026-08-06T17:04:53.694Z\", \"assignerShortName\": \"CIRCL\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…