PT-2026-31440 · Ail+1 · Ail Framework

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39416

Mitre

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Amber

AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in 6.8.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39416

Affected Products

Ail Framework

References · 3

• https://github.com/ail-project/ail-framework/security/advisories/GHSA-fj6v-43r7-gcjm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39416 · Security Note
• https://vulnerability.circl.lu/vuln/gcve-1-2026-0023 · Note