CVE-2026-71447

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71447", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-08-06T17:04:47.831Z", "datePublished": "2026-08-06T17:04:53.694Z", "dateUpdated": "2026-08-07T13:56:39.535Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ail-framework", "repo": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45", "vendor": "ail-project", "versions": [{"lessThanOrEqual": "7.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "Aurelien Thirion"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.</p><p>The affected templates inserted message and post identifiers directly into inline JavaScript <code>onclick</code> handlers:</p><pre><code>onclick=\"translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)\"</code></pre><p>and:</p><pre><code>onclick=\"translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)\"</code></pre><p>These values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.</p><p>Because the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.</p><p>Successful exploitation requires the victim to click the affected <strong>Translate to preferred language</strong> button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance.</p><br>"}], "value": "AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\n\nThe affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:\n\nonclick=\"translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)\"\n\nand:\n\nonclick=\"translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)\"\n\nThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\n\nBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\n\nSuccessful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance."}], "impacts": [{"capecId": "CAPEC-243", "descriptions": [{"lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes"}]}, {"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-08-06T17:08:52.223Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T13:56:25.186159Z", "id": "CVE-2026-71447", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T13:56:39.535Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71447", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T13:56:25.186159Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T13:56:31.933Z"}}], "cna": {"title": "Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "Aurelien Thirion"}], "impacts": [{"capecId": "CAPEC-243", "descriptions": [{"lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes"}]}, {"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45", "vendor": "ail-project", "product": "ail-framework", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.0.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\n\nThe affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:\n\nonclick=\"translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)\"\n\nand:\n\nonclick=\"translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)\"\n\nThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\n\nBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\n\nSuccessful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance.", "supportingMedia": [{"type": "text/html", "value": "<p>AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.</p><p>The affected templates inserted message and post identifiers directly into inline JavaScript <code>onclick</code> handlers:</p><pre><code>onclick=\"translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)\"</code></pre><p>and:</p><pre><code>onclick=\"translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)\"</code></pre><p>These values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.</p><p>Because the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.</p><p>Successful exploitation requires the victim to click the affected <strong>Translate to preferred language</strong> button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-08-06T17:08:52.223Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71447", "state": "PUBLISHED", "dateUpdated": "2026-08-07T13:56:39.535Z", "dateReserved": "2026-08-06T17:04:47.831Z", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "datePublished": "2026-08-06T17:04:53.694Z", "assignerShortName": "CIRCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ail-framework", "repo": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45", "vendor": "ail-project", "versions": [{"lessThanOrEqual": "7.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\n\nThe affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:\n\nonclick=\"translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)\"\n\nand:\n\nonclick=\"translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)\"\n\nThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\n\nBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\n\nSuccessful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim\u2019s browser under the security origin of the AIL instance."}, {"lang": "es", "value": "El Proyecto AIL contiene una vulnerabilidad de cross-site scripting almacenado en los controles de traducci\u00f3n mostrados para mensajes de chat y publicaciones de foro.\n\nLas plantillas afectadas insertaban identificadores de mensajes y publicaciones directamente en los gestores onclick de JavaScript en l\u00ednea:\n\nonclick_disabled=\u201ctranslateMessageToPreferredLanguage(\u2019{{ message[\u2019id\u2019] }}\u2019, \u2019{{ mess_id_escape }}\u2019, this)\u201d\n\ny:\n\nonclick_disabled=\u201ctranslatePostToPreferredLanguage(\u2019{{ post[\u2019id\u2019] }}\u2019, \u2019{{ post_id_escape }}\u2019, this)\u201d\n\nEstos valores estaban escapados para plantillas HTML, pero no estaban codificados de forma segura para su uso como literales de cadena de JavaScript dentro de un atributo HTML. Un identificador especialmente dise\u00f1ado que contenga comillas, caracteres de escape u otra sintaxis de JavaScript podr\u00eda, por lo tanto, terminar el argumento de cadena esperado e inyectar JavaScript arbitrario en el gestor de eventos.\n\nDebido a que los valores afectados est\u00e1n asociados con mensajes de chat o publicaciones de foro indexados, un valor malicioso puede permanecer almacenado por AIL y ser renderizado cada vez que un analista acceda a la vista de explorador de chat o foro correspondiente.\n\nLa explotaci\u00f3n exitosa requiere que la v\u00edctima haga clic en el bot\u00f3n afectado \u2019Traducir al idioma preferido\u2019. El c\u00f3digo inyectado se ejecutar\u00eda entonces en el navegador de la v\u00edctima bajo el origen de seguridad de la instancia de AIL."}], "id": "CVE-2026-71447", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71447", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T13:56:25.186159Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:18:31.460", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ail-framework", "source": "cna", "vendor": "ail-project"}, "product": "ail-framework", "vendor": "ail-project"}], "created": "2026-08-07T01:30:04.026966+00:00", "updated": "2026-08-07T02:15:04.033748+00:00", "vendors": ["ail-project", "ail-project$PRODUCT$ail-framework"]}