CVE-2026-71447 is a stored cross-site scripting vulnerability in ail-framework's translation controls for chat messages and forum posts. The vulnerability is due to improper encoding of message and post identifiers in inline JavaScript onclick handlers. Although these values are HTML-template escaped, they are not safely encoded for JavaScript string literals inside HTML attributes, allowing injection of arbitrary JavaScript if an attacker crafts identifiers with quotation marks or escape characters. The malicious script executes when a user clicks the 'Translate to preferred language' button, running in the security context of the affected AIL instance.

An attacker can inject and execute arbitrary JavaScript code in the browser of any user who clicks the affected translation button on chat messages or forum posts containing malicious identifiers. This can lead to actions such as session hijacking, unauthorized actions on behalf of the user, or other malicious behaviors within the security context of the ail-framework instance. The vulnerability is stored, meaning the malicious payload persists and affects multiple users over time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid clicking the 'Translate to preferred language' buttons on untrusted or suspicious chat messages and forum posts. Monitor official ail-project communications for updates and patches addressing this vulnerability.