The AIL Framework contains a stored XSS vulnerability in the templates var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. These templates render popovers using Bootstrap with data-html="true" and interpolate dynamic values such as icon color, style, glyph, subtype, identifier, name, description, and matched value directly into the data-content attribute without proper output encoding. An authenticated attacker able to influence matched, tracked, or tagged content can inject arbitrary HTML or JavaScript that persists and executes in other users' browsers when they view the popovers, enabling potential data theft or actions under the victim's session.

An authenticated attacker can inject persistent malicious scripts into popover content that executes in the context of other users' browsers. This can lead to data exfiltration or unauthorized actions performed with the victim's privileges. The vulnerability affects the confidentiality and integrity of user sessions within the AIL Framework application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or carefully validate user input that influences matched, tracked, or tagged content rendered in popovers. Consider disabling HTML rendering in popovers or applying proper output encoding to dynamic values in the affected templates to prevent script injection.