{"uuid": "ebfa798b-fbba-4210-927f-b70de8eecfb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12228", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/116943308400000440", "content": "\ud83d\udd77 Bugs Alerts\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udea8 New Vulnerability!\n\ud83c\udd94 CVE ID:CVE-2026-12228\ud83d\udcca Severity: \ud83d\udfe0 HIGH\ud83d\udcc8 CVSS Score: 8.7\ud83d\udcc5 Published: 2026-07-18 21:17 UTC\n\ud83d\udcdd Description:A stored cross-site scripting (XSS) vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled prompt_content into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through MessageContentRenderer, which uses v-html...\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\ud83d\udc68\u200d\ud83d\udcbb", "creation_timestamp": "2026-07-18T22:21:15.497066Z"}