The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in \".onion\"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in \".onion\" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler's task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler's target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services.
"}],"value":"The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in \".onion\"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in \".onion\" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler's task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler's target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services."}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Parameter Tampering"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-25T13:42:16.854Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The length-based shortcut that bypassed onion-domain validation is removed. Every extracted URL is now parsed using the standard URL domain extraction function, and the resulting hostname is validated against the existing onion-domain validation routine before the URL is added to the crawler task set. This ensures that only URLs whose hostname is a genuine .onion domain can be queued as crawler tasks.
"}],"value":"The length-based shortcut that bypassed onion-domain validation is removed. Every extracted URL is now parsed using the standard URL domain extraction function, and the resulting hostname is validated against the existing onion-domain validation routine before the URL is added to the crawler task set. This ensures that only URLs whose hostname is a genuine .onion domain can be queued as crawler tasks."}],"title":"AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"none","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version range is inferred from the tag_version_boundary metadata indicating the fix commit is 24 commits before the v7.1 tag; the exact version number of the vulnerable release is not specified in the patch.","The CVSS assumes the attacker can place crafted content in a location the AIL Framework crawler will process; the specific crawling scope and configuration are not detailed in the patch.","CAPEC-126 (Parameter Tampering) is the closest available attack pattern; the actual attack is content-based URL injection rather than classic request parameter tampering, so the mapping is approximate.","The impact is assessed as Low Integrity based on the evidence that non-onion URLs are queued as crawler tasks; broader downstream consequences (e.g., SSRF-like effects) are not evidenced in the patch and are not assumed.","The commit date (24 Sep 2026) is taken as-is from the patch metadata; no independent verification of the timeline is performed."],"capecRationale":[{"capecId":"CAPEC-126","rationale":"The attacker tampers with URL parameters embedded in untrusted crawled content to bypass the application's validation logic and inject non-onion targets into the crawler task queue. CAPEC-126 is the closest available pattern describing manipulation of input parameters to achieve unintended application behavior. The mapping is approximate because the attack vector is content-based injection rather than direct request parameter manipulation, but the core mechanism (crafting input to bypass validation) aligns with this pattern."}],"commit":"5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"terrtia"}],"cvssRationale":"Attack Vector is Network because the attacker publishes crafted content on the web that the framework crawls. Attack Complexity is Low because the attacker only needs to construct a URL of exactly 69 characters ending in .onion with a non-onion hostname. No special Adversary Techniques are required. Privileges Required is None because the attacker is an unauthenticated content publisher. User Interaction is None because the crawler processes the content automatically. The primary impact is Low Integrity on the vulnerable component: the crawler task queue is polluted with non-onion URLs, violating the integrity of the framework's target selection. No confidentiality or availability impact is evident from the patch. No subsequent component impact is identified in the evidence.","fixSummary":"The length-based shortcut that bypassed onion-domain validation is removed. Every extracted URL is now parsed using the standard URL domain extraction function, and the resulting hostname is validated against the existing onion-domain validation routine before the URL is added to the crawler task set. This ensures that only URLs whose hostname is a genuine .onion domain can be queued as crawler tasks.","generatedAt":"2026-09-25T13:37:37.543009Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":5}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"9fbf191128229c1859f3643b5f50921cdf5f36fd70734e8f68a05e237b987d60","patchSummary":"In bin/modules/Onion.py, the conditional block that checked len(url) == 69 and url.endswith('.onion') to shortcut domain extraction (url[7:]) without calling crawlers.is_valid_onion_domain() is removed. The code is replaced with an unconditional call to crawlers.get_url_domain(url) followed by a check that the returned domain is truthy and passes crawlers.is_valid_onion_domain(domain) before adding the domain and URL to the respective sets. Net change: 2 insertions, 9 deletions in a single file.","patchTruncated":false,"patches":[{"commit":"5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb","patchSha256":"9fbf191128229c1859f3643b5f50921cdf5f36fd70734e8f68a05e237b987d60","source":"https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb.patch","sourceUrl":"https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb.patch","subject":"chg: [security] Onion module, prevent non-onion crawler task"}],"source":"https://github.com/ail-project/ail-framework/commit/5c8a68b3d8c7d7b03e5febe4ac5b5aca91826adb.patch","subject":"chg: [security] Onion module, prevent non-onion crawler task","tagVersionBoundary":{"commits_after_fix":24,"repository":"https://github.com/ail-project/ail-framework","tag":"v7.1","version":"7.1","version_type":"custom"},"weaknessRationale":[{"cweId":"CWE-20","rationale":"The URL input was validated using an insufficient heuristic (string length and suffix) that could be satisfied by non-onion URLs. The proper hostname parsing and onion-domain validation step was bypassed by the shortcut, allowing attacker-controlled URLs to be accepted as valid onion targets."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20276"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-100187","datePublished":"2026-09-25T13:42:16.854Z","dateReserved":"2026-09-25T13:42:12.578Z","dateUpdated":"2026-09-25T14:49:57.208Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 14:17:17","lastModifiedDate":"2026-09-25 15:17:52","problem_types":["CWE-20","CWE-20 CWE-20 Improper Input Validation"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:45:47.206440Z","id":"CVE-2026-100187","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"100187","Ordinal":"1","Title":"AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Ta","CVE":"CVE-2026-100187","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"100187","Ordinal":"1","NoteData":"The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending in \".onion\"), without performing proper hostname parsing or onion-domain validation. An unauthenticated attacker who could publish or control web content crawled by the framework could embed a crafted URL containing an IP address or non-onion hostname with a path ending in \".onion\" that satisfied the length and suffix conditions. Such a URL would be extracted, its domain naively sliced from the string, and queued as a legitimate onion crawler task. This allowed unauthenticated content publishers to inject arbitrary non-onion targets into the crawler's task queue, influencing crawler behavior and potentially directing it toward unintended network resources. The vulnerability required no authentication, no user interaction, and only the ability to place crafted content in a location the framework would crawl. The security impact is a loss of integrity in the crawler's target selection: the framework processes and acts upon URLs that do not correspond to legitimate .onion services.","Type":"Description","Title":"AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Ta"}]}}}