The ail-framework component of the AIL Project suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, message and post identifiers are embedded into inline JavaScript onclick handlers without safe encoding for JavaScript string literals, despite being HTML-template escaped. This flaw allows an attacker to craft identifiers containing quotation marks or escape characters that break out of the intended string context and inject arbitrary JavaScript code. Because these identifiers are stored and rendered in chat and forum views, the malicious payload persists and executes when a user clicks the 'Translate to preferred language' button. The vulnerability affects ail-framework versions up to and including 7.0.0. There is no vendor advisory or patch information currently available. Exploitation requires user interaction (click) and privileges are low, but the impact on confidentiality is high due to script execution in the victim's browser.

Successful exploitation results in arbitrary JavaScript execution within the security context of the affected AIL instance in the victim's browser. This can lead to actions such as session hijacking, unauthorized actions on behalf of the user, or theft of sensitive information accessible to the browser. The vulnerability is stored, meaning the malicious payload persists and can affect multiple users who view the compromised chat messages or forum posts and interact with the translation controls. Exploitation requires user interaction (clicking the translation button).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input in JavaScript contexts without proper encoding. Users should exercise caution when clicking translation buttons in chat or forum views. Monitor vendor channels for updates or patches addressing this vulnerability.