This vulnerability is a Stored Cross-Site Scripting (CWE-79) in the parisneo/lollms product affecting versions before 2.2.0. It occurs in the create_post function within backend/routers/social/__init__.py, where user-supplied content is assigned directly to the DBPost model without proper sanitization. As a result, attackers can inject malicious JavaScript that executes in the context of users' browsers when they view the Home Feed, including administrators. The CVSS 3.0 score is 9.6 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vulnerability is resolved in version 2.2.0.

Successful exploitation allows attackers to execute arbitrary JavaScript in the browsers of users viewing the Home Feed, potentially leading to account takeover, session hijacking, and propagation of wormable attacks. This compromises confidentiality, integrity, and availability of affected user accounts and the application environment.

Upgrade parisneo/lollms to version 2.2.0 or later, where this vulnerability is fixed. Since the vendor has released an official fix, applying this update is the recommended remediation. No other mitigation guidance is provided or required.