CVE-2026-71445 is a reflected XSS vulnerability in the AIL Framework's /tag/add_tags endpoint. When an error occurs during tag processing, the application returns the error message directly as HTML using str(res[0]) without output encoding. If the error message includes attacker-controlled input, an attacker can craft a request that causes arbitrary HTML or JavaScript to be reflected in the response. The attack requires user interaction with an authenticated session, allowing execution of malicious scripts in the victim's browser context, potentially leading to session abuse or unauthorized actions.

Successful exploitation allows execution of arbitrary JavaScript in the context of the AIL Framework application within the victim's browser. This can lead to unauthorized actions performed with the victim's session privileges, access to sensitive information available to the victim, or modification of data through authenticated requests. The attack requires the victim to be authenticated and to interact with a maliciously crafted link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid interacting with untrusted links that target the /tag/add_tags endpoint. Implementing proper output encoding on error messages in the application code is recommended once a patch or update is provided.