CVE-2026-71447 (GCVE-0-2026-71447)

Vulnerability from cvelistv5 – Published: 2026-08-06 17:04 – Updated: 2026-08-07 13:56
VLAI
Title
Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework
Summary
AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)" and: onclick="translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)" These values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler. Because the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view. Successful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim’s browser under the security origin of the AIL instance.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
ail-project ail-framework Affected: 0 , ≤ 7.0.0 (semver)
Create a notification for this product.
Credits
Jeroen Pinoy Aurelien Thirion
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T13:56:25.186159Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T13:56:39.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ail-framework",
          "repo": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45",
          "vendor": "ail-project",
          "versions": [
            {
              "lessThanOrEqual": "7.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\u003c/p\u003e\u003cp\u003eThe affected templates inserted message and post identifiers directly into inline JavaScript \u003ccode\u003eonclick\u003c/code\u003e handlers:\u003c/p\u003e\u003cpre\u003e\u003ccode\u003eonclick=\"translateMessageToPreferredLanguage(\u0027{{ message[\u0027id\u0027] }}\u0027, \u0027{{ mess_id_escape }}\u0027, this)\"\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eand:\u003c/p\u003e\u003cpre\u003e\u003ccode\u003eonclick=\"translatePostToPreferredLanguage(\u0027{{ post[\u0027id\u0027] }}\u0027, \u0027{{ post_id_escape }}\u0027, this)\"\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\u003c/p\u003e\u003cp\u003eBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\u003c/p\u003e\u003cp\u003eSuccessful exploitation requires the victim to click the affected \u003cstrong\u003eTranslate to preferred language\u003c/strong\u003e button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\n\nThe affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:\n\nonclick=\"translateMessageToPreferredLanguage(\u0027{{ message[\u0027id\u0027] }}\u0027, \u0027{{ mess_id_escape }}\u0027, this)\"\n\nand:\n\nonclick=\"translatePostToPreferredLanguage(\u0027{{ post[\u0027id\u0027] }}\u0027, \u0027{{ post_id_escape }}\u0027, this)\"\n\nThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\n\nBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\n\nSuccessful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-243",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-243 XSS Targeting HTML Attributes"
            }
          ]
        },
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T17:08:52.223Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-71447",
    "datePublished": "2026-08-06T17:04:53.694Z",
    "dateReserved": "2026-08-06T17:04:47.831Z",
    "dateUpdated": "2026-08-07T13:56:39.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71447",
      "date": "2026-08-07",
      "epss": "0.00234",
      "percentile": "0.14311"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-71447\",\"sourceIdentifier\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"published\":\"2026-08-06T22:18:31.460\",\"lastModified\":\"2026-08-07T14:17:00.957\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\\n\\nThe affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:\\n\\nonclick=\\\"translateMessageToPreferredLanguage(\u0027{{ message[\u0027id\u0027] }}\u0027, \u0027{{ mess_id_escape }}\u0027, this)\\\"\\n\\nand:\\n\\nonclick=\\\"translatePostToPreferredLanguage(\u0027{{ post[\u0027id\u0027] }}\u0027, \u0027{{ post_id_escape }}\u0027, this)\\\"\\n\\nThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\\n\\nBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\\n\\nSuccessful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance.\"}],\"affected\":[{\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"affectedData\":[{\"vendor\":\"ail-project\",\"product\":\"ail-framework\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"7.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-07T13:56:25.186159Z\",\"id\":\"CVE-2026-71447\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45\",\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"ail-framework\", \"repo\": \"https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45\", \"vendor\": \"ail-project\", \"versions\": [{\"lessThanOrEqual\": \"7.0.0\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jeroen Pinoy\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Aurelien Thirion\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cp\u003eAIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\u003c/p\u003e\u003cp\u003eThe affected templates inserted message and post identifiers directly into inline JavaScript \u003ccode\u003eonclick\u003c/code\u003e handlers:\u003c/p\u003e\u003cpre\u003e\u003ccode\u003eonclick=\\\"translateMessageToPreferredLanguage(\u0027{{ message[\u0027id\u0027] }}\u0027, \u0027{{ mess_id_escape }}\u0027, this)\\\"\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eand:\u003c/p\u003e\u003cpre\u003e\u003ccode\u003eonclick=\\\"translatePostToPreferredLanguage(\u0027{{ post[\u0027id\u0027] }}\u0027, \u0027{{ post_id_escape }}\u0027, this)\\\"\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\u003c/p\u003e\u003cp\u003eBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\u003c/p\u003e\u003cp\u003eSuccessful exploitation requires the victim to click the affected \u003cstrong\u003eTranslate to preferred language\u003c/strong\u003e button. The injected code would then execute in the victim\\u2019s browser under the security origin of the AIL instance.\u003c/p\u003e\u003cbr\u003e\"}], \"value\": \"AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\\n\\nThe affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:\\n\\nonclick=\\\"translateMessageToPreferredLanguage(\u0027{{ message[\u0027id\u0027] }}\u0027, \u0027{{ mess_id_escape }}\u0027, this)\\\"\\n\\nand:\\n\\nonclick=\\\"translatePostToPreferredLanguage(\u0027{{ post[\u0027id\u0027] }}\u0027, \u0027{{ post_id_escape }}\u0027, this)\\\"\\n\\nThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\\n\\nBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\\n\\nSuccessful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim\\u2019s browser under the security origin of the AIL instance.\"}], \"impacts\": [{\"capecId\": \"CAPEC-243\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-243 XSS Targeting HTML Attributes\"}]}, {\"capecId\": \"CAPEC-592\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-592 Stored XSS\"}]}], \"metrics\": [{\"cvssV4_0\": {\"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"attackVector\": \"NETWORK\", \"baseScore\": 6.9, \"baseSeverity\": \"MEDIUM\", \"privilegesRequired\": \"LOW\", \"providerUrgency\": \"NOT_DEFINED\", \"subAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"userInteraction\": \"ACTIVE\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"shortName\": \"CIRCL\", \"dateUpdated\": \"2026-08-06T17:08:52.223Z\"}, \"references\": [{\"tags\": [\"patch\"], \"url\": \"https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework\", \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-71447\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-07T13:56:25.186159Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-07T13:56:31.933Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-71447\", \"assignerOrgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"CIRCL\", \"dateReserved\": \"2026-08-06T17:04:47.831Z\", \"datePublished\": \"2026-08-06T17:04:53.694Z\", \"dateUpdated\": \"2026-08-07T13:56:39.535Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.