CVE-2026-71446 is a stored cross-site scripting vulnerability in the ail-framework's crawler domain view. Crawled URLs were directly embedded into a JavaScript onclick handler without proper context-aware encoding, allowing an attacker who can insert a crafted URL into the crawler history to inject executable JavaScript. When an authenticated analyst clicks the affected screenshot icon, the malicious script executes in their browser under the application's security context. The vulnerability was remediated by serializing the URL with Jinja's tojson filter to prevent injection by escaping characters that could break out of the JavaScript string.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the analyst's session, potentially allowing access to sensitive information, modification of displayed content, or performing actions with the analyst's privileges. Exploitation requires user interaction with the malicious entry and authenticated access to the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed by applying Jinja's tojson filter to the URL before embedding it in JavaScript, which safely escapes dangerous characters. Users should update to a version that includes this fix once available. Until then, avoid clicking suspicious screenshot icons in the crawler domain view.