CVE-2026-39416 is a stored XSS vulnerability in the ail-framework open-source platform used for data collection and analysis. The vulnerability arises because the modal item preview feature returns attacker-controlled content longer than 800 characters without specifying a safe content type, enabling browsers to execute injected JavaScript code. This affects versions prior to 6.8. The vulnerability has a CVSS 4.0 base score of 8.5, indicating high severity. No known exploits in the wild have been reported. The issue is resolved in version 6.8.

Successful exploitation allows execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This can lead to unauthorized actions performed with the user's privileges, data theft, or session hijacking. The vulnerability requires no user interaction beyond viewing the crafted content and does not require elevated privileges to exploit, but the attacker must have the ability to inject content into the item preview. There are no reports of active exploitation.

Upgrade ail-framework to version 6.8 or later, where this vulnerability is fixed. Since no official patch links or advisories are provided, users should verify the version and apply the update accordingly. Patch status is confirmed fixed in version 6.8. No additional mitigations are specified.