CVE-2026-71446

{
  "id": "CVE-2026-71446",
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
  "published": "2026-08-06T22:18:31.317",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding.\n\nAn attacker who can cause a specially crafted URL to be recorded in the crawler history can inject JavaScript syntax into the stored URL value. The payload remains stored by AIL and is subsequently included in the domain view. When an authenticated analyst clicks the screenshot icon associated with the malicious URL, the injected JavaScript executes in the analyst’s browser within the security context of the AIL Framework application.\n\nSuccessful exploitation could allow an attacker to access information available to the analyst’s session, modify displayed content, or perform application actions using the analyst’s privileges. Exploitation requires the victim to interact with the affected screenshot entry.\n\nThe vulnerability was corrected by serializing the crawled URL with Jinja’s tojson filter before inserting it into the JavaScript handler. This safely escapes characters that could otherwise terminate the JavaScript string and introduce executable code."
    },
    {
      "lang": "es",
      "value": "AIL Framework contiene una vulnerabilidad de cross-site scripting almacenado en la vista de dominio del rastreador. Las URLs rastreadas se incrustaron directamente en el gestor JavaScript onclick utilizado para mostrar una captura de pantalla almacenada, sin codificación apropiada para el contexto.\n\nUn atacante que puede hacer que una URL especialmente diseñada sea registrada en el historial del rastreador puede inyectar sintaxis JavaScript en el valor de la URL almacenada. La carga útil permanece almacenada por AIL y se incluye posteriormente en la vista de dominio. Cuando un analista autenticado hace clic en el icono de captura de pantalla asociado con la URL maliciosa, el JavaScript inyectado se ejecuta en el navegador del analista dentro del contexto de seguridad de la aplicación AIL Framework.\n\nLa explotación exitosa podría permitir a un atacante acceder a información disponible para la sesión del analista, modificar el contenido mostrado o realizar acciones de la aplicación utilizando los privilegios del analista. La explotación requiere que la víctima interactúe con la entrada de captura de pantalla afectada.\n\nLa vulnerabilidad fue corregida serializando la URL rastreada con el filtro tojson de Jinja antes de insertarla en el gestor JavaScript. Esto escapa de forma segura los caracteres que de otro modo podrían terminar la cadena JavaScript e introducir código ejecutable."
    }
  ],
  "affected": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "affectedData": [
        {
          "vendor": "ail-project",
          "product": "ail-framework",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/ail-project/ail-framework/",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "7.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T13:54:13.900870Z",
          "id": "CVE-2026-71446",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ail-project/ail-framework/commit/37aabee8b23503a7782ed5effb92b11ab7db5150",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ]
}