This vulnerability in parisneo/lollms arises from improper neutralization of input during web page generation (CWE-79). Specifically, the from_dict method in the AppLollmsMessage class fails to sanitize or encode the content field when processing user-supplied data. This flaw enables attackers to inject malicious HTML or JavaScript payloads that execute in other users' browsers, potentially compromising user sessions and accounts. The CVSS 3.0 score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impact on confidentiality and integrity but not availability. No patch or official remediation guidance is currently available.

Exploitation of this vulnerability can result in execution of arbitrary scripts in the context of other users, leading to account takeover, session hijacking, and potentially wormable attacks that propagate across users. The confidentiality and integrity of user data are at risk. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when processing untrusted input in the affected component. Avoid using vulnerable versions if possible and monitor official channels for updates.