CVE-2026-71445

Name of the Vulnerable Software and Affected Versions AIL Framework (affected versions not specified)

Description A reflected cross-site scripting issue exists in the '/tag/add tags' endpoint. When a tag operation fails, the application returns the error value as an HTML response via the str(res[0]) function without proper output encoding. An attacker can exploit this by tricking an authenticated user into clicking a crafted link, allowing arbitrary JavaScript to execute in the victim's browser. This could enable the attacker to perform actions using the victim's session, access sensitive information, or modify data. The attack requires user interaction and does not necessarily require the attacker to have an account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/tag/add tags' endpoint to minimize the risk of exploitation.