PT-2026-32142 · Parisneo · Lollms

Published 2026-01-12 · Updated 2026-04-12 · CVE-2026-1116

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 2.2.0

Description A Cross-site Scripting (XSS) vulnerability exists in the from dict method of the AppLollmsMessage class. The issue is due to insufficient sanitization or HTML encoding of the content field when processing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads that can execute in the context of another user's browser. Successful exploitation could lead to account takeover or session hijacking.

Recommendations Update to version 2.2.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-06490

CVE-2026-1116

Affected Products

Lollms

References · 6

• 🔥 https://huntr.com/bounties/d3d076a7-2a51-4e07-8d0e-91e28e76788e · Exploit
• https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a · Patch
• https://bdu.fstec.ru/vul/2026-06490 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1116 · Security Note
• https://twitter.com/VulmonFeeds/status/2043171316744769771 · Twitter Post
• https://twitter.com/CVEarity/status/2043308464722866263 · Twitter Post