CVE-2026-100174

Name of the Vulnerable Software and Affected Versions AIL Framework (affected versions not specified)

Description The tag selector component located at var/www/static/js/tags.js is susceptible to stored cross-site scripting (XSS). An authenticated user with permissions to create custom tags can embed HTML payloads containing JavaScript event handlers within a tag name. The issue occurs because the renderComboItems function and the selected-tag rendering logic pass the displayField value directly to the jQuery html property, which inserts the string as raw HTML into the Document Object Model (DOM) instead of treating it as plain text. This allows arbitrary JavaScript execution in the browser of any authenticated user who views a page rendering the malicious tag, potentially leading to session hijacking, unauthorized data access, or form manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.