CVE-2026-100190: Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page
The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts within the HTML template. This included an onclick attribute that embedded raw screenshot and URL values into a JavaScript function call, and an inline script block that assigned a screenshot value to a JavaScript variable without escaping. An attacker with a user-role API client could craft a malicious crawler capture import containing JavaScript payloads in these fields. When any user (including privileged users) subsequently viewed the affected domain page, the injected script would execute in the victim's browser context, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the victim. The vulnerability is stored in the application's data layer and triggered upon page rendering, requiring no further interaction beyond loading the domain view.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the AIL Framework crawler splash domain page (showDomain.html) so imported crawler-capture values (item IDs, URLs, and screenshot paths) are removed from inline JavaScript contexts; store them in HTML data attributes (data-screenshot, data-url, data-item-id) with Jinja2 HTML escaping, bind screenshot click handlers via addEventListener on .reload-image elements, and have reload_image read values from the element dataset. URL-encode item IDs with encodeURIComponent before placing them in link hrefs.
Event History
Frequently Asked Questions
Who can exploit this issue, and who is affected when it is triggered?
An attacker needs a user-role API client and the ability to import a crafted crawler capture. Any user who later loads the affected domain page can have attacker-supplied JavaScript execute in their browser, including privileged users.
Which imported data fields can carry the malicious payload?
The affected fields are crawler-capture item IDs, URLs, and screenshot file paths. These values were inserted into inline JavaScript contexts on the domain page without escaping.
Does exploitation require the victim to click anything on the page?
No. The stored payload executes when the affected domain view is rendered, so loading the page is sufficient.
What is the relevant remediation reference?
The provided reference is commit 31376ee3d04519c898bb9b3671453a41c4117340 in the AIL Framework repository.