PT-2026-31440 · Unknown · Ail Framework

CVE-2026-39416 · Published 2026-04-08 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Amber

Name of the Vulnerable Software and Affected Versions AIL framework versions prior to 6.8

Description A stored cross-site scripting (XSS) issue exists in the modal item preview functionality. When processing item content exceeding 800 characters, the system returns attacker-controlled content without an explicit text/plain content type. This allows the browser to interpret the response as active HTML, potentially leading to the execution of arbitrary JavaScript within the session of an authenticated user viewing the crafted item.

Recommendations Update AIL framework to version 6.8.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39416

GHSA-FJ6V-43R7-GCJM

Affected Products

Ail Framework

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39416.json · Exploit
• https://github.com/ail-project/ail-framework/security/advisories/GHSA-fj6v-43r7-gcjm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-39416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39416 · Security Note
• https://vulnerability.circl.lu/vuln/gcve-1-2026-0023 · Note