GCVE-1-2026-20276 (CVE-2026-100187)

Vulnerability from gna-1 – Published: 2026-09-25 13:40 – Updated: 2026-09-25 13:53
VLAI
Title
AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation
Summary
The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in ".onion"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in ".onion" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler's task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler's target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-20 - Improper Input Validation
Assigner
GNA-1 This instance
References
Impacted products
Vendor Product Version CPE status
ail project ail framework Affected: unspecified , < 7.1 (semver)
guessed Create a notification for this product.
Credits
Aurelien Thirion Jeroen Pinoy
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-25 13:37
Model
qwen3.8:27b
Input
https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb.patch 9fbf19112822…
Confidence
medium
Commit Subject Patch SHA-256
5c8a68b3d8c7 chg: [security] Onion module, prevent non-onion crawler task 9fbf19112822…
Fix summary

The length-based shortcut that bypassed onion-domain validation is removed. Every extracted URL is now parsed using the standard URL domain extraction function, and the resulting hostname is validated against the existing onion-domain validation routine before the URL is added to the crawler task set. This ensures that only URLs whose hostname is a genuine .onion domain can be queued as crawler tasks.

Patch summary

In bin/modules/Onion.py, the conditional block that checked len(url) == 69 and url.endswith('.onion') to shortcut domain extraction (url[7:]) without calling crawlers.is_valid_onion_domain() is removed. The code is replaced with an unconditional call to crawlers.get_url_domain(url) followed by a check that the returned domain is truthy and passes crawlers.is_valid_onion_domain(domain) before adding the domain and URL to the respective sets. Net change: 2 insertions, 9 deletions in a single file.

CVSS rationale

Attack Vector is Network because the attacker publishes crafted content on the web that the framework crawls. Attack Complexity is Low because the attacker only needs to construct a URL of exactly 69 characters ending in .onion with a non-onion hostname. No special Adversary Techniques are required. Privileges Required is None because the attacker is an unauthenticated content publisher. User Interaction is None because the crawler processes the content automatically. The primary impact is Low Integrity on the vulnerable component: the crawler task queue is polluted with non-onion URLs, violating the integrity of the framework's target selection. No confidentiality or availability impact is evident from the patch. No subsequent component impact is identified in the evidence.

Weakness rationale
  • CWE-20 The URL input was validated using an insufficient heuristic (string length and suffix) that could be satisfied by non-onion URLs. The proper hostname parsing and onion-domain validation step was bypassed by the shortcut, allowing attacker-controlled URLs to be accepted as valid onion targets.
Attack pattern rationale
  • CAPEC-126 The attacker tampers with URL parameters embedded in untrusted crawled content to bypass the application's validation logic and inject non-onion targets into the crawler task queue. CAPEC-126 is the closest available pattern describing manipulation of input parameters to achieve unintended application behavior. The mapping is approximate because the attack vector is content-based injection rather than direct request parameter manipulation, but the core mechanism (crafting input to bypass validation) aligns with this pattern.
Assumptions to verify
  • The affected version range is inferred from the tag_version_boundary metadata indicating the fix commit is 24 commits before the v7.1 tag; the exact version number of the vulnerable release is not specified in the patch.
  • The CVSS assumes the attacker can place crafted content in a location the AIL Framework crawler will process; the specific crawling scope and configuration are not detailed in the patch.
  • CAPEC-126 (Parameter Tampering) is the closest available attack pattern; the actual attack is content-based URL injection rather than classic request parameter tampering, so the mapping is approximate.
  • The impact is assessed as Low Integrity based on the evidence that non-onion URLs are queued as crawler tasks; broader downstream consequences (e.g., SSRF-like effects) are not evidenced in the patch and are not assumed.
  • The commit date (24 Sep 2026) is taken as-is from the patch metadata; no independent verification of the timeline is performed.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 5 9 medium 5
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Onion module"
          ],
          "product": "ail framework",
          "programFiles": [
            "bin/modules/Onion.py"
          ],
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail project",
          "versions": [
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in \".onion\"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in \".onion\" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler\u0027s task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler\u0027s target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services.\u003c/p\u003e"
            }
          ],
          "value": "The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in \".onion\"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in \".onion\" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler\u0027s task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler\u0027s target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe length-based shortcut that bypassed onion-domain validation is removed. Every extracted URL is now parsed using the standard URL domain extraction function, and the resulting hostname is validated against the existing onion-domain validation routine before the URL is added to the crawler task set. This ensures that only URLs whose hostname is a genuine .onion domain can be queued as crawler tasks.\u003c/p\u003e"
            }
          ],
          "value": "The length-based shortcut that bypassed onion-domain validation is removed. Every extracted URL is now parsed using the standard URL domain extraction function, and the resulting hostname is validated against the existing onion-domain validation routine before the URL is added to the crawler task set. This ensures that only URLs whose hostname is a genuine .onion domain can be queued as crawler tasks."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata indicating the fix commit is 24 commits before the v7.1 tag; the exact version number of the vulnerable release is not specified in the patch.",
                  "The CVSS assumes the attacker can place crafted content in a location the AIL Framework crawler will process; the specific crawling scope and configuration are not detailed in the patch.",
                  "CAPEC-126 (Parameter Tampering) is the closest available attack pattern; the actual attack is content-based URL injection rather than classic request parameter tampering, so the mapping is approximate.",
                  "The impact is assessed as Low Integrity based on the evidence that non-onion URLs are queued as crawler tasks; broader downstream consequences (e.g., SSRF-like effects) are not evidenced in the patch and are not assumed.",
                  "The commit date (24 Sep 2026) is taken as-is from the patch metadata; no independent verification of the timeline is performed."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker tampers with URL parameters embedded in untrusted crawled content to bypass the application\u0027s validation logic and inject non-onion targets into the crawler task queue. CAPEC-126 is the closest available pattern describing manipulation of input parameters to achieve unintended application behavior. The mapping is approximate because the attack vector is content-based injection rather than direct request parameter manipulation, but the core mechanism (crafting input to bypass validation) aligns with this pattern."
                  }
                ],
                "commit": "5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "terrtia"
                  }
                ],
                "cvssRationale": "Attack Vector is Network because the attacker publishes crafted content on the web that the framework crawls. Attack Complexity is Low because the attacker only needs to construct a URL of exactly 69 characters ending in .onion with a non-onion hostname. No special Adversary Techniques are required. Privileges Required is None because the attacker is an unauthenticated content publisher. User Interaction is None because the crawler processes the content automatically. The primary impact is Low Integrity on the vulnerable component: the crawler task queue is polluted with non-onion URLs, violating the integrity of the framework\u0027s target selection. No confidentiality or availability impact is evident from the patch. No subsequent component impact is identified in the evidence.",
                "fixSummary": "The length-based shortcut that bypassed onion-domain validation is removed. Every extracted URL is now parsed using the standard URL domain extraction function, and the resulting hostname is validated against the existing onion-domain validation routine before the URL is added to the crawler task set. This ensures that only URLs whose hostname is a genuine .onion domain can be queued as crawler tasks.",
                "generatedAt": "2026-09-25T13:37:37.543009Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "9fbf191128229c1859f3643b5f50921cdf5f36fd70734e8f68a05e237b987d60",
                "patchSummary": "In bin/modules/Onion.py, the conditional block that checked len(url) == 69 and url.endswith(\u0027.onion\u0027) to shortcut domain extraction (url[7:]) without calling crawlers.is_valid_onion_domain() is removed. The code is replaced with an unconditional call to crawlers.get_url_domain(url) followed by a check that the returned domain is truthy and passes crawlers.is_valid_onion_domain(domain) before adding the domain and URL to the respective sets. Net change: 2 insertions, 9 deletions in a single file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb",
                    "patchSha256": "9fbf191128229c1859f3643b5f50921cdf5f36fd70734e8f68a05e237b987d60",
                    "source": "https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb.patch",
                    "sourceUrl": "https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb.patch",
                    "subject": "chg: [security] Onion module, prevent non-onion crawler task"
                  }
                ],
                "source": "https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb.patch",
                "subject": "chg: [security] Onion module, prevent non-onion crawler task",
                "tagVersionBoundary": {
                  "commits_after_fix": 24,
                  "repository": "https://github.com/ail-project/ail-framework",
                  "tag": "v7.1",
                  "version": "7.1",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The URL input was validated using an insufficient heuristic (string length and suffix) that could be satisfied by non-onion URLs. The proper hostname parsing and onion-domain validation step was bypassed by the shortcut, allowing attacker-controlled URLs to be accepted as valid onion targets."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20276"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-100187",
    "datePublished": "2026-09-25T13:40:00.000Z",
    "dateReserved": "2026-09-25T13:42:00.000Z",
    "dateUpdated": "2026-09-25T13:53:04.756019Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20276"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.