Vulnerability-Lookup

GHSA-FG9R-9HMH-7X8C

Vulnerability from github – Published: 2026-09-25 15:31 – Updated: 2026-09-25 15:31

Details

The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html="true", the content is interpreted as HTML in the victim's browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim's session, potentially enabling data exfiltration or actions with the victim's privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content.

Severity

8.5 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-100172"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T14:17:15Z",
    "severity": "HIGH"
  },
  "details": "The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html=\"true\", the content is interpreted as HTML in the victim\u0027s browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim\u0027s session, potentially enabling data exfiltration or actions with the victim\u0027s privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content.",
  "id": "GHSA-fg9r-9hmh-7x8c",
  "modified": "2026-09-25T15:31:46Z",
  "published": "2026-09-25T15:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100172"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-100172 (GCVE-0-2026-100172)

Vulnerability from cvelistv5 – Published: 2026-09-25 13:13 – Updated: 2026-09-25 15:19

Title

Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes

Summary

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 15:15 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

CIRCL ENISA root

References

1 reference

URL	Tags
https://github.com/ail-project/ail-framework/comm…	patch

Impacted products

1 product

Vendor	Product	Version
ail project	ail framework	Affected: unspecified , < 7.1 (semver)

Credits

Aurelien Thirion Jeroen Pinoy

GCVE extensions

AI-generated Not human-reviewed Confidence: medium Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02

AI involvement GCVE-BCP-05-X-01

Whole record AI-generated Not human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

Patch provenance GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-09-25 12:56
Model: qwen3.8:27b
Input: https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch bd188338f882…
Confidence: medium

Commit	Subject	Patch SHA-256
`ee63a0a96646`	chg: [security] fix XSS in show item and message popover of	`bd188338f882…`

Fix summary

The fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields.

Patch summary

In block_message.html and show_item.html, the Jinja2 expressions for extracted_matches fields (icon color, icon style, icon, subtype, id, name, description) and the matched value r[1] are each suffixed with |forceescape|forceescape. No other logic, routing, or configuration changes are made. Two lines changed in total (one per file).

CVSS rationale

AV:N: web application reachable over the network. AC:L: crafting a message or item with a malicious extracted-match value requires no special race or timing. AT:N: no manipulation of the attack target is needed. PR:L: the attacker must be an authenticated user capable of creating or modifying chat messages or items. UI:P: the victim must passively interact (hover over the element) to trigger the popover rendering; no click or explicit action is required. VC:H: the injected script can read session cookies, DOM data, and API responses in the victim's browser. VI:H: the script can perform authenticated actions on behalf of the victim (create, modify, delete data). VA:N: no direct denial-of-service impact is evident. SC/SI/SA:N: the subcomponent (the AIL Framework server) is not directly compromised; the impact is confined to the victim's browser session.

Weakness rationale

CWE-79 Dynamic values from extracted-match data are interpolated into an HTML-enabled attribute without output encoding, allowing script injection. The fix adds forceescape, confirming the root cause is missing output encoding in an HTML context. CWE-79 is the precise weakness.

Attack pattern rationale

CAPEC-1 The patch directly addresses stored XSS: attacker-controlled content is persisted in application data (chat messages, items) and rendered as executable HTML in a victim's browser via an unescaped data-content attribute. CAPEC-1 is the canonical attack pattern for XSS and is the closest match. No uncertainty in this mapping.

Assumptions to verify

The AIL Framework requires authenticated access to create or modify chat messages and items; PR:L is assumed based on the application being a threat-intelligence platform with user accounts.
The extracted-match data (icon color, style, subtype, id, name, description) can be influenced by an authenticated user through normal application workflows (e.g., submitting content that the extraction pipeline processes).
The popover is triggered on hover (data-trigger="hover"), classified as passive user interaction (UI:P).
The tag v7.1 boundary with 143 commits after the fix suggests the fix landed before v7.1, but exact affected version ranges are not confirmed by the patch alone.
CAPEC-1 is selected as the closest standard attack pattern; no more specific CAPEC for stored XSS in HTML attributes exists in the CAPEC catalog.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	5	9	medium	5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100172",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T15:15:12.313075Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T15:19:12.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "chats_explorer (block_message.html)",
            "objects/item (show_item.html)"
          ],
          "product": "ail framework",
          "programFiles": [
            "var/www/templates/chats_explorer/block_message.html",
            "var/www/templates/objects/item/show_item.html"
          ],
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail project",
          "versions": [
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html=\"true\", the content is interpreted as HTML in the victim\u0027s browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim\u0027s session, potentially enabling data exfiltration or actions with the victim\u0027s privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content.\u003c/p\u003e"
            }
          ],
          "value": "The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html=\"true\", the content is interpreted as HTML in the victim\u0027s browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim\u0027s session, potentially enabling data exfiltration or actions with the victim\u0027s privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T13:13:56.996Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields."
        }
      ],
      "title": "Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The AIL Framework requires authenticated access to create or modify chat messages and items; PR:L is assumed based on the application being a threat-intelligence platform with user accounts.",
                  "The extracted-match data (icon color, style, subtype, id, name, description) can be influenced by an authenticated user through normal application workflows (e.g., submitting content that the extraction pipeline processes).",
                  "The popover is triggered on hover (data-trigger=\"hover\"), classified as passive user interaction (UI:P).",
                  "The tag v7.1 boundary with 143 commits after the fix suggests the fix landed before v7.1, but exact affected version ranges are not confirmed by the patch alone.",
                  "CAPEC-1 is selected as the closest standard attack pattern; no more specific CAPEC for stored XSS in HTML attributes exists in the CAPEC catalog."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The patch directly addresses stored XSS: attacker-controlled content is persisted in application data (chat messages, items) and rendered as executable HTML in a victim\u0027s browser via an unescaped data-content attribute. CAPEC-1 is the canonical attack pattern for XSS and is the closest match. No uncertainty in this mapping."
                  }
                ],
                "commit": "ee63a0a96646790255e038f5ca5dd0ab5fe98db2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "terrtia"
                  }
                ],
                "cvssRationale": "AV:N: web application reachable over the network. AC:L: crafting a message or item with a malicious extracted-match value requires no special race or timing. AT:N: no manipulation of the attack target is needed. PR:L: the attacker must be an authenticated user capable of creating or modifying chat messages or items. UI:P: the victim must passively interact (hover over the element) to trigger the popover rendering; no click or explicit action is required. VC:H: the injected script can read session cookies, DOM data, and API responses in the victim\u0027s browser. VI:H: the script can perform authenticated actions on behalf of the victim (create, modify, delete data). VA:N: no direct denial-of-service impact is evident. SC/SI/SA:N: the subcomponent (the AIL Framework server) is not directly compromised; the impact is confined to the victim\u0027s browser session.",
                "fixSummary": "The fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields.",
                "generatedAt": "2026-09-25T12:56:24.137641Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "bd188338f8828ab59743776228d2991b51a3f83b870dedf073a54c6139ad9e26",
                "patchSummary": "In block_message.html and show_item.html, the Jinja2 expressions for extracted_matches fields (icon color, icon style, icon, subtype, id, name, description) and the matched value r[1] are each suffixed with |forceescape|forceescape. No other logic, routing, or configuration changes are made. Two lines changed in total (one per file).",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ee63a0a96646790255e038f5ca5dd0ab5fe98db2",
                    "patchSha256": "bd188338f8828ab59743776228d2991b51a3f83b870dedf073a54c6139ad9e26",
                    "source": "https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch",
                    "sourceUrl": "https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch",
                    "subject": "chg: [security] fix XSS in show item and message popover of"
                  }
                ],
                "source": "https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch",
                "subject": "chg: [security] fix XSS in show item and message popover of",
                "tagVersionBoundary": {
                  "commits_after_fix": 143,
                  "repository": "https://github.com/ail-project/ail-framework",
                  "tag": "v7.1",
                  "version": "7.1",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "Dynamic values from extracted-match data are interpolated into an HTML-enabled attribute without output encoding, allowing script injection. The fix adds forceescape, confirming the root cause is missing output encoding in an HTML context. CWE-79 is the precise weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-100172",
    "datePublished": "2026-09-25T13:13:56.996Z",
    "dateReserved": "2026-09-25T13:13:52.747Z",
    "dateUpdated": "2026-09-25T15:19:12.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-FG9R-9HMH-7X8C

CVE-2026-100172 (GCVE-0-2026-100172)

Fix summary

Patch summary

CVSS rationale

Weakness rationale

Attack pattern rationale

Assumptions to verify

Model comparison

Tags

Sightings

Nomenclature

Related by attack behaviour