CVE-2026-39416: Stored XSS in modal item preview for long item content in AIL Framework
AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in 6.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AIL frameworkto a version that resolves this vulnerability.Fixed in 6.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39416?
The severity of CVE-2026-39416 is high with a CVSS score of 8.5.
How do I fix CVE-2026-39416?
To fix CVE-2026-39416, update to AIL Framework version 6.8 or later which addresses the stored XSS vulnerability.
What is the impact of CVE-2026-39416?
CVE-2026-39416 allows an attacker to execute arbitrary scripts in the context of the user’s session through stored cross-site scripting.
Who is affected by CVE-2026-39416?
Users of AIL Framework versions prior to 6.8 are affected by CVE-2026-39416.
How does CVE-2026-39416 occur?
CVE-2026-39416 occurs when the modal item preview functionality fails to sanitize item content longer than 800 characters.