CVE-2026-71445 is a reflected XSS vulnerability in the ail-framework's /tag/add_tags endpoint. When processing tag operations, error messages are returned directly as HTML using str(res[0]) without proper encoding, allowing injection of arbitrary HTML or JavaScript if attacker-controlled input is included. An attacker can exploit this by convincing an authenticated user to open a specially crafted link, enabling script execution in the victim's browser under the application's security context. This may allow the attacker to perform actions with the victim's privileges or access sensitive information. The vulnerability affects ail-framework versions up to and including 7.0.0. No official patch or remediation level has been published yet.

Successful exploitation allows execution of arbitrary JavaScript in the context of the ail-framework application within the victim's browser. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, and access or modification of data accessible to the victim. The attack requires the victim to be authenticated and to interact with a crafted link. The vulnerability does not require the attacker to have an account but depends on delivering the crafted request to an authenticated user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on untrusted links while authenticated to the ail-framework application. Application administrators should monitor for updates from the vendor regarding official patches or mitigations.