The AIL Framework's showDomain.html page is vulnerable to stored XSS due to unsafe interpolation of user-supplied data from imported crawler captures into inline JavaScript. Specifically, item IDs, URLs, and screenshot file paths are embedded directly into an onclick attribute and an inline script block without proper escaping. An attacker with user-role API client privileges can craft malicious imports containing JavaScript payloads. When any user views the domain page, the injected scripts execute in their browser, potentially compromising session security and enabling unauthorized actions. The vulnerability is stored in the application's data layer and triggered upon page rendering without additional user interaction.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the affected domain page, including privileged users. This can lead to session hijacking, data theft, and unauthorized actions performed on behalf of the victim. The vulnerability is persistent (stored XSS) and triggered automatically when the page loads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user-role API client permissions to trusted users only and avoid importing untrusted crawler capture data. Users should be cautious when viewing domain pages that display imported crawler data.