Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

AIL Framework preview can run malicious code

CVE-2026-39416 · published 7 months ago
Summary

The AIL Framework’s item preview feature could display long, attacker‑controlled content as active web code instead of plain text. This allowed a malicious user to run JavaScript when an authenticated user viewed the crafted item, potentially stealing data or hijacking the session. Upgrade to version 6.8 or later, which forces plain‑text handling, to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
circl ail_framework <= 6.7
cpe:2.3:a:circl:ail_framework:*:*:*:*:*:*:*:*
Original advisory text
Stored XSS in modal item preview for long item content in AIL Framework
AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in 6.8.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published8 Apr 2026
Updated4 Nov 2026
First seen15 Apr 2026
Sources
CVE-2026-39416 · NVD
CVE-2026-39416 · OSV
GHSA-fj6v-43r7-gcjm · GHSA
Track software like this
Free during beta