Vulnerability-Lookup

CVE-2026-71445 (GCVE-0-2026-71445)

Vulnerability from cvelistv5 – Published: 2026-08-06 16:48 – Updated: 2026-08-07 13:55

Title

Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework

Summary

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]). If attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link. Successful exploitation could allow JavaScript to execute in the victim’s browser within the security context of the AIL Framework application. Depending on the victim’s privileges and the application’s protections, the attacker could perform actions using the victim’s session, access information available to the victim, or modify data through authenticated application requests. The vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-07 13:55 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

CIRCL CNA under the ENISA root

CNA scorecard A 90/100 over 244 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/ail-project/ail-framework/comm…	patch

Impacted products

1 product

Vendor	Product	Version	CPE status
ail-project	ail-framework	Affected: 0 , ≤ 7.0.0 (semver)	guessed

Credits

Jeroen Pinoy Aurelien Thirion

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71445",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T13:55:35.949767Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T13:55:55.951Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ail-framework",
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail-project",
          "versions": [
            {
              "lessThanOrEqual": "7.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAIL Framework contained a reflected cross-site scripting vulnerability in the \u003ccode\u003e/tag/add_tags\u003c/code\u003e endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using \u003ccode\u003estr(res[0])\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eIf attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.\u003c/p\u003e\u003cp\u003eSuccessful exploitation could allow JavaScript to execute in the victim\u2019s browser within the security context of the AIL Framework application. Depending on the victim\u2019s privileges and the application\u2019s protections, the attacker could perform actions using the victim\u2019s session, access information available to the victim, or modify data through authenticated application requests.\u003c/p\u003e\u003cp\u003eThe vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]).\n\nIf attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.\n\nSuccessful exploitation could allow JavaScript to execute in the victim\u2019s browser within the security context of the AIL Framework application. Depending on the victim\u2019s privileges and the application\u2019s protections, the attacker could perform actions using the victim\u2019s session, access information available to the victim, or modify data through authenticated application requests.\n\nThe vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T16:48:50.682Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/4faf5117b15b4a6208d56f8c54f51c58b87eb007"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-71445",
    "datePublished": "2026-08-06T16:48:50.682Z",
    "dateReserved": "2026-08-06T16:48:01.625Z",
    "dateUpdated": "2026-08-07T13:55:55.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71445",
      "date": "2026-10-20",
      "epss": "0.00396",
      "percentile": "0.32391"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "ail-framework",
                "repo": "https://github.com/ail-project/ail-framework",
                "vendor": "ail-project",
                "versions": [
                  {
                    "lessThanOrEqual": "7.0.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]).\n\nIf attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.\n\nSuccessful exploitation could allow JavaScript to execute in the victim\u2019s browser within the security context of the AIL Framework application. Depending on the victim\u2019s privileges and the application\u2019s protections, the attacker could perform actions using the victim\u2019s session, access information available to the victim, or modify data through authenticated application requests.\n\nThe vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user."
          }
        ],
        "id": "CVE-2026-71445",
        "lastModified": "2026-08-26T16:49:18.760",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "LOW",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-71445",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T13:55:35.949767Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-06T22:18:31.163",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/ail-project/ail-framework/commit/4faf5117b15b4a6208d56f8c54f51c58b87eb007"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71445",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-07T13:55:35.949767Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-07T13:55:44.409Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "ail-framework",
              "repo": "https://github.com/ail-project/ail-framework",
              "vendor": "ail-project",
              "versions": [
                {
                  "lessThanOrEqual": "7.0.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Jeroen Pinoy"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Aurelien Thirion"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAIL Framework contained a reflected cross-site scripting vulnerability in the \u003ccode\u003e/tag/add_tags\u003c/code\u003e endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using \u003ccode\u003estr(res[0])\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eIf attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.\u003c/p\u003e\u003cp\u003eSuccessful exploitation could allow JavaScript to execute in the victim\u2019s browser within the security context of the AIL Framework application. Depending on the victim\u2019s privileges and the application\u2019s protections, the attacker could perform actions using the victim\u2019s session, access information available to the victim, or modify data through authenticated application requests.\u003c/p\u003e\u003cp\u003eThe vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user.\u003c/p\u003e\u003cbr\u003e"
                }
              ],
              "value": "AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]).\n\nIf attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.\n\nSuccessful exploitation could allow JavaScript to execute in the victim\u2019s browser within the security context of the AIL Framework application. Depending on the victim\u2019s privileges and the application\u2019s protections, the attacker could perform actions using the victim\u2019s session, access information available to the victim, or modify data through authenticated application requests.\n\nThe vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-591",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-591 Reflected XSS"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "LOW",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-06T16:48:50.682Z",
            "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "shortName": "CIRCL"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/ail-project/ail-framework/commit/4faf5117b15b4a6208d56f8c54f51c58b87eb007"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "assignerShortName": "CIRCL",
        "cveId": "CVE-2026-71445",
        "datePublished": "2026-08-06T16:48:50.682Z",
        "dateReserved": "2026-08-06T16:48:01.625Z",
        "dateUpdated": "2026-08-07T13:55:55.951Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-71445

Vulnerability from fkie_nvd - Published: 2026-08-06 22:18 - Updated: 2026-08-26 16:49

Severity

8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Summary

References

	URL	Tags
	5a6e4751-2f3f-4070-9419-94fb35b644e8	https://github.com/ail-project/ail-framework/commit/4faf5117b15b4a6208d56f8c54f51c58b87eb007

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "ail-framework",
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail-project",
          "versions": [
            {
              "lessThanOrEqual": "7.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]).\n\nIf attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.\n\nSuccessful exploitation could allow JavaScript to execute in the victim\u2019s browser within the security context of the AIL Framework application. Depending on the victim\u2019s privileges and the application\u2019s protections, the attacker could perform actions using the victim\u2019s session, access information available to the victim, or modify data through authenticated application requests.\n\nThe vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user."
    }
  ],
  "id": "CVE-2026-71445",
  "lastModified": "2026-08-26T16:49:18.760",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-71445",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T13:55:35.949767Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-06T22:18:31.163",
  "references": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "url": "https://github.com/ail-project/ail-framework/commit/4faf5117b15b4a6208d56f8c54f51c58b87eb007"
    }
  ],
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "type": "Secondary"
    }
  ]
}

GCVE-1-2026-20147 (CVE-2026-71445)

Vulnerability from gna-1 – Published: 2026-08-06 16:47 – Updated: 2026-08-06 16:48

Title

Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework

Summary

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

CIRCL GNA GNA-1 This instance

GNA scorecard A 90/100 over 252 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/ail-project/ail-framework/comm…	patch

Impacted products

1 product

Vendor	Product	Version
ail-project	ail-framework	Affected: 0 , ≤ 7.0.0 (semver)

Credits

Jeroen Pinoy Aurelien Thirion

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ail-framework",
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail-project",
          "versions": [
            {
              "lessThanOrEqual": "7.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAIL Framework contained a reflected cross-site scripting vulnerability in the \u003ccode\u003e/tag/add_tags\u003c/code\u003e endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using \u003ccode\u003estr(res[0])\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eIf attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.\u003c/p\u003e\u003cp\u003eSuccessful exploitation could allow JavaScript to execute in the victim\u2019s browser within the security context of the AIL Framework application. Depending on the victim\u2019s privileges and the application\u2019s protections, the attacker could perform actions using the victim\u2019s session, access information available to the victim, or modify data through authenticated application requests.\u003c/p\u003e\u003cp\u003eThe vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]).\n\nIf attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.\n\nSuccessful exploitation could allow JavaScript to execute in the victim\u2019s browser within the security context of the AIL Framework application. Depending on the victim\u2019s privileges and the application\u2019s protections, the attacker could perform actions using the victim\u2019s session, access information available to the victim, or modify data through authenticated application requests.\n\nThe vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/4faf5117b15b4a6208d56f8c54f51c58b87eb007"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20147"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-71445",
    "datePublished": "2026-08-06T16:47:00.000Z",
    "dateReserved": "2026-08-06T16:48:00.000Z",
    "dateUpdated": "2026-08-06T16:48:38.055308Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20147"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-MCPQ-XXXJ-MC69

Vulnerability from github – Published: 2026-08-07 00:31 – Updated: 2026-08-07 00:31

Details

If attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.

Successful exploitation could allow JavaScript to execute in the victim’s browser within the security context of the AIL Framework application. Depending on the victim’s privileges and the application’s protections, the attacker could perform actions using the victim’s session, access information available to the victim, or modify data through authenticated application requests.

The vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user.

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-71445"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-06T22:18:31Z",
    "severity": "HIGH"
  },
  "details": "AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]).\n\nIf attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.\n\nSuccessful exploitation could allow JavaScript to execute in the victim\u2019s browser within the security context of the AIL Framework application. Depending on the victim\u2019s privileges and the application\u2019s protections, the attacker could perform actions using the victim\u2019s session, access information available to the victim, or modify data through authenticated application requests.\n\nThe vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user.",
  "id": "GHSA-mcpq-xxxj-mc69",
  "modified": "2026-08-07T00:31:23Z",
  "published": "2026-08-07T00:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71445"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ail-project/ail-framework/commit/4faf5117b15b4a6208d56f8c54f51c58b87eb007"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-71445 (GCVE-0-2026-71445)

FKIE_CVE-2026-71445

GCVE-1-2026-20147 (CVE-2026-71445)

GHSA-MCPQ-XXXJ-MC69

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour