PT-2026-31885 · Parisneo · Lollms

Published 2026-04-10 · Updated 2026-04-11 · CVE-2026-1115

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 2.2.0

Description A Stored Cross-Site Scripting (XSS) vulnerability exists in the social feature of parisneo/lollms. The vulnerability is located in the create post function within backend/routers/social/ init .py, where user-provided content is directly assigned to the DBPost model without proper sanitization. This allows attackers to inject malicious JavaScript that is executed in the browsers of users viewing the Home Feed, potentially leading to account takeover, session hijacking, and wormable attacks.

Recommendations Upgrade to version 2.2.0 to resolve the vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1115

GHSA-8WRQ-FV5F-PFP2

Affected Products

Lollms

References · 10

• 🔥 https://huntr.com/bounties/099aa4fe-7165-4337-889c-3fb4f1aa71aa · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1115 · Security Note
• https://osv.dev/vulnerability/GHSA-8wrq-fv5f-pfp2 · Vendor Advisory
• https://github.com/ParisNeo/lollms · Note
• https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a · Note
• https://twitter.com/0dayPublishing/status/2042500212946514170 · Twitter Post
• https://twitter.com/giuseppe_1337/status/2042504298949427390 · Twitter Post
• https://twitter.com/pulsepatchio/status/2042797239416885520 · Twitter Post
• https://twitter.com/CveFindCom/status/2042508675131035904 · Twitter Post
• https://twitter.com/CVEnew/status/2042561733882188231 · Twitter Post