CVE-2026-1116

A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` field when deserializing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads, which can be executed in the context of another user's browser. Exploitation of this vulnerability can lead to account takeover, session hijacking, or wormable attacks.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a	Patch
https://huntr.com/bounties/d3d076a7-2a51-4e07-8d0e-91e28e76788e	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Cross-site Scripting (XSS) fue identificada en el método ’from_dict’ de la clase ’AppLollmsMessage’ en parisneo/lollms anterior a la versión 2.2.0. La vulnerabilidad surge de la falta de saneamiento o codificación HTML del campo ’content’ al deserializar datos proporcionados por el usuario. Esto permite a un atacante inyectar cargas útiles HTML o JavaScript maliciosas, que pueden ser ejecutadas en el contexto del navegador de otro usuario. La explotación de esta vulnerabilidad puede llevar a la toma de control de cuentas, secuestro de sesión o ataques tipo gusano.

Information

Published : 2026-04-12 03:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-1116

Mitre link : CVE-2026-1116

CVE.ORG link : CVE-2026-1116

JSON object : View

Products Affected

lollms

lollms

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-1116", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1116", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T17:49:21.295282Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "parisneo", "product": "parisneo/lollms", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.2.0", "versionType": "custom"}]}]}], "published": "2026-04-12T03:16:07.600", "references": [{"url": "https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/d3d076a7-2a51-4e07-8d0e-91e28e76788e", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` field when deserializing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads, which can be executed in the context of another user's browser. Exploitation of this vulnerability can lead to account takeover, session hijacking, or wormable attacks."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-site Scripting (XSS) fue identificada en el m\u00e9todo \u2019from_dict\u2019 de la clase \u2019AppLollmsMessage\u2019 en parisneo/lollms anterior a la versi\u00f3n 2.2.0. La vulnerabilidad surge de la falta de saneamiento o codificaci\u00f3n HTML del campo \u2019content\u2019 al deserializar datos proporcionados por el usuario. Esto permite a un atacante inyectar cargas \u00fatiles HTML o JavaScript maliciosas, que pueden ser ejecutadas en el contexto del navegador de otro usuario. La explotaci\u00f3n de esta vulnerabilidad puede llevar a la toma de control de cuentas, secuestro de sesi\u00f3n o ataques tipo gusano."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7118851E-5C3C-499B-BBB5-0327B7FD85AF", "versionEndIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}