The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html=\"true\", the content is interpreted as HTML in the victim's browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim's session, potentially enabling data exfiltration or actions with the victim's privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content.
"}],"value":"The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html=\"true\", the content is interpreted as HTML in the victim's browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim's session, potentially enabling data exfiltration or actions with the victim's privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content."}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Cross Site Scripting (XSS)"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.5,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-25T13:13:56.996Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields.
"}],"value":"The fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields."}],"title":"Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"none","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The AIL Framework requires authenticated access to create or modify chat messages and items; PR:L is assumed based on the application being a threat-intelligence platform with user accounts.","The extracted-match data (icon color, style, subtype, id, name, description) can be influenced by an authenticated user through normal application workflows (e.g., submitting content that the extraction pipeline processes).","The popover is triggered on hover (data-trigger=\"hover\"), classified as passive user interaction (UI:P).","The tag v7.1 boundary with 143 commits after the fix suggests the fix landed before v7.1, but exact affected version ranges are not confirmed by the patch alone.","CAPEC-1 is selected as the closest standard attack pattern; no more specific CAPEC for stored XSS in HTML attributes exists in the CAPEC catalog."],"capecRationale":[{"capecId":"CAPEC-1","rationale":"The patch directly addresses stored XSS: attacker-controlled content is persisted in application data (chat messages, items) and rendered as executable HTML in a victim's browser via an unescaped data-content attribute. CAPEC-1 is the canonical attack pattern for XSS and is the closest match. No uncertainty in this mapping."}],"commit":"ee63a0a96646790255e038f5ca5dd0ab5fe98db2","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"terrtia"}],"cvssRationale":"AV:N: web application reachable over the network. AC:L: crafting a message or item with a malicious extracted-match value requires no special race or timing. AT:N: no manipulation of the attack target is needed. PR:L: the attacker must be an authenticated user capable of creating or modifying chat messages or items. UI:P: the victim must passively interact (hover over the element) to trigger the popover rendering; no click or explicit action is required. VC:H: the injected script can read session cookies, DOM data, and API responses in the victim's browser. VI:H: the script can perform authenticated actions on behalf of the victim (create, modify, delete data). VA:N: no direct denial-of-service impact is evident. SC/SI/SA:N: the subcomponent (the AIL Framework server) is not directly compromised; the impact is confined to the victim's browser session.","fixSummary":"The fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields.","generatedAt":"2026-09-25T12:56:24.137641Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":5}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"bd188338f8828ab59743776228d2991b51a3f83b870dedf073a54c6139ad9e26","patchSummary":"In block_message.html and show_item.html, the Jinja2 expressions for extracted_matches fields (icon color, icon style, icon, subtype, id, name, description) and the matched value r[1] are each suffixed with |forceescape|forceescape. No other logic, routing, or configuration changes are made. Two lines changed in total (one per file).","patchTruncated":false,"patches":[{"commit":"ee63a0a96646790255e038f5ca5dd0ab5fe98db2","patchSha256":"bd188338f8828ab59743776228d2991b51a3f83b870dedf073a54c6139ad9e26","source":"https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch","sourceUrl":"https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch","subject":"chg: [security] fix XSS in show item and message popover of"}],"source":"https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch","subject":"chg: [security] fix XSS in show item and message popover of","tagVersionBoundary":{"commits_after_fix":143,"repository":"https://github.com/ail-project/ail-framework","tag":"v7.1","version":"7.1","version_type":"custom"},"weaknessRationale":[{"cweId":"CWE-79","rationale":"Dynamic values from extracted-match data are interpolated into an HTML-enabled attribute without output encoding, allowing script injection. The fix adds forceescape, confirming the root cause is missing output encoding in an HTML context. CWE-79 is the precise weakness."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20239"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-100172","datePublished":"2026-09-25T13:13:56.996Z","dateReserved":"2026-09-25T13:13:52.747Z","dateUpdated":"2026-09-25T15:19:12.598Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 14:17:15","lastModifiedDate":"2026-09-25 16:17:24","problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:15:12.313075Z","id":"CVE-2026-100172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"100172","Ordinal":"1","Title":"Stored XSS in AIL Framework extracted-match popovers via unescap","CVE":"CVE-2026-100172","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"100172","Ordinal":"1","NoteData":"The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html=\"true\", the content is interpreted as HTML in the victim's browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim's session, potentially enabling data exfiltration or actions with the victim's privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content.","Type":"Description","Title":"Stored XSS in AIL Framework extracted-match popovers via unescap"}]}}}