CVE-2026-71446 is a stored XSS vulnerability in the ail-framework's crawler domain view. The issue arises because crawled URLs are embedded directly into a JavaScript onclick handler without context-appropriate encoding, allowing injection of arbitrary JavaScript. An attacker who can cause a malicious URL to be recorded in the crawler history can inject script code that executes when an authenticated analyst clicks the screenshot icon for that URL. This execution occurs within the security context of the application, potentially allowing session information disclosure or unauthorized actions. The vulnerability is fixed by serializing the URL with Jinja's tojson filter to escape characters that could break out of the JavaScript string context.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated analyst's session. This can lead to disclosure of sensitive information accessible to the analyst, modification of displayed content, or performing actions with the analyst's privileges. Exploitation requires user interaction with the malicious screenshot entry. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was corrected by applying Jinja's tojson filter to serialize the URL before embedding it in JavaScript, which safely escapes dangerous characters. Until an official fix is confirmed and applied, avoid clicking on untrusted or suspicious screenshot entries in the crawler domain view to prevent triggering the stored XSS payload.