CVE-2026-100172

Name of the Vulnerable Software and Affected Versions AIL Framework (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in two Jinja2 templates used to render popovers for matched, tracked, or tagged content: var/www/templates/chats explorer/block message.html and var/www/templates/objects/item/show item.html. Dynamic values such as icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value are inserted into the data-content HTML attribute of Bootstrap popover elements without proper output encoding. Since these popovers use data-html="true", the browser interprets the content as HTML. An authenticated attacker capable of influencing this content can inject arbitrary HTML or JavaScript, which executes in the session of a victim viewing the popover, potentially leading to data exfiltration or unauthorized actions using the victim's privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.