CVE-2026-39416 Stored XSS in modal item preview for long item content in AIL Framework
Attackers can execute arbitrary JavaScript in authenticated users' browsers via stored XSS in the modal item preview of the AIL Framework.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39416?
CVE-2026-39416 is a high-severity cross-site scripting vulnerability in ail-project ail-framework, published on 8 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in 6.8.
Weakness: CWE-79
Which versions are affected by CVE-2026-39416?
It affects 1 product.
Products include Circl Ail Framework.
How do I fix CVE-2026-39416?
No fix has been published for CVE-2026-39416 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-39416 being exploited?
There is no known exploitation of CVE-2026-39416 in the wild and no public exploit code.
Other vulnerabilities in ail-project ail-framework
Sources
Also known as GHSA-fj6v-43r7-gcjm.