CVE-2026-71447

Full vulnerability record from the local CVENow database.

Description

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)" and: onclick="translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)" These values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler. Because the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view. Successful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim’s browser under the security origin of the AIL instance.

Severity

MEDIUM

CVSS score

6.9 (v4.0)

Vulnerability status

Deferred

Source identifier

5a6e4751-2f3f-4070-9419-94fb35b644e8

Published

2026-08-06 22:18:31.460000

Last modified

2026-10-24 15:10:00.190000

View original CVE JSON

{
  "id": "CVE-2026-71447",
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
  "published": "2026-08-06T22:18:31.460",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.\n\nThe affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:\n\nonclick=\"translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)\"\n\nand:\n\nonclick=\"translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)\"\n\nThese values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.\n\nBecause the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.\n\nSuccessful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim’s browser under the security origin of the AIL instance."
    },
    {
      "lang": "es",
      "value": "El Proyecto AIL contiene una vulnerabilidad de cross-site scripting almacenado en los controles de traducción mostrados para mensajes de chat y publicaciones de foro.\n\nLas plantillas afectadas insertaban identificadores de mensajes y publicaciones directamente en los gestores onclick de JavaScript en línea:\n\nonclick_disabled=“translateMessageToPreferredLanguage(’{{ message[’id’] }}’, ’{{ mess_id_escape }}’, this)”\n\ny:\n\nonclick_disabled=“translatePostToPreferredLanguage(’{{ post[’id’] }}’, ’{{ post_id_escape }}’, this)”\n\nEstos valores estaban escapados para plantillas HTML, pero no estaban codificados de forma segura para su uso como literales de cadena de JavaScript dentro de un atributo HTML. Un identificador especialmente diseñado que contenga comillas, caracteres de escape u otra sintaxis de JavaScript podría, por lo tanto, terminar el argumento de cadena esperado e inyectar JavaScript arbitrario en el gestor de eventos.\n\nDebido a que los valores afectados están asociados con mensajes de chat o publicaciones de foro indexados, un valor malicioso puede permanecer almacenado por AIL y ser renderizado cada vez que un analista acceda a la vista de explorador de chat o foro correspondiente.\n\nLa explotación exitosa requiere que la víctima haga clic en el botón afectado ’Traducir al idioma preferido’. El código inyectado se ejecutaría entonces en el navegador de la víctima bajo el origen de seguridad de la instancia de AIL."
    }
  ],
  "affected": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "affectedData": [
        {
          "vendor": "ail-project",
          "product": "ail-framework",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "7.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T13:56:25.186159Z",
          "id": "CVE-2026-71447",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ail-project/ail-framework/commit/884662517cf02c3eac928fa68c5a19ec35138b45",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ]
}