The vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms, where the prompt_content parameter is stored directly into DBDirectMessage.content without proper server-side sanitization. When a victim views the direct message thread, the content is rendered using MessageContentRenderer with v-html, which inserts HTML directly into the DOM. The frontend uses a regex-based sanitizer that fails to fully neutralize malicious HTML, enabling stored XSS attacks. This allows any authenticated user to send a crafted prompt-share message that executes arbitrary JavaScript in the victim's browser, leading to authenticated actions, data exposure, and potential account takeover. The CVSS 3.0 score is 8.7 (High) with network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality and integrity with scope changed.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the victim's browser when they open the malicious direct message. This can lead to unauthorized actions performed as the victim, exposure of sensitive application data within the same origin, and potentially full account takeover. The vulnerability compromises confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with shared prompts from other users. Because the vulnerability requires authenticated access and user interaction, limiting exposure by restricting message sharing or applying additional input sanitization server-side may reduce risk. Monitor vendor channels for updates and apply patches promptly once released.