CVE-2026-100190 is a stored cross-site scripting (XSS) vulnerability in the AIL Framework's crawler splash domain page (showDomain.html). Malicious JavaScript payloads can be injected via user-supplied data fields such as item IDs, URLs, and screenshot file paths originating from imported crawler captures. This vulnerability allows execution of arbitrary scripts in the context of users viewing the affected page, potentially leading to session hijacking or unauthorized actions. The flaw requires an attacker with user-role API client access to import crafted data, and triggers upon page rendering without additional user interaction.
CVE-2026-100187 is an input validation vulnerability in the Onion module of the AIL Framework. The module incorrectly validates .onion URLs by only checking for a fixed length and suffix, without proper hostname parsing. This flaw allows unauthenticated attackers who can publish content crawled by the framework to inject arbitrary non-onion URLs into the crawler's task queue. The vulnerability leads to loss of integrity in the crawler's target selection, potentially causing the crawler to access unintended network resources. No authentication or user interaction is required to exploit this issue.
CVE-2026-100177 is an authorization bypass vulnerability in the ail framework's crawler task creation API. It allows an authenticated user with permission to create crawler tasks to attach another organization's cookiejar by UUID without proper access checks. This can lead to unauthorized use of another organization's stored cookies and session data during web crawls, potentially exposing sensitive session tokens and authentication credentials.
CVE-2026-100176 is a stored cross-site scripting (XSS) vulnerability in the AIL Framework's username timeline feature. Usernames imported from external sources are stored without sanitization and rendered unsafely in the analyst's browser using D3's html() method. An attacker can craft a malicious username containing HTML event handlers that execute arbitrary JavaScript when an authenticated analyst hovers over the timeline entry. Exploitation requires the victim to be authenticated and interact with the malicious entry. This can lead to session hijacking, data exfiltration, or unauthorized actions within the analyst's session.
CVE-2026-100174 is a stored cross-site scripting (XSS) vulnerability in the AIL Framework's tag selector component. An authenticated user with permission to create custom tags can embed malicious JavaScript in a tag name. When another authenticated user views a page with the malicious tag, the script executes in their browser. This occurs because the tag name is inserted as raw HTML via jQuery's html property without proper sanitization. Exploitation can lead to arbitrary script execution within the application's origin, risking session hijacking and unauthorized data access.
The AIL Framework contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render Bootstrap popovers. Dynamic values are directly interpolated into the data-content HTML attribute without proper encoding, allowing authenticated attackers to inject arbitrary HTML or JavaScript. This injected content executes in the victim's browser when viewing the affected popovers, potentially enabling data exfiltration or actions with the victim's privileges. The vulnerability affects matched, tracked, or tagged content and is classified as stored XSS due to persistence of the malicious payload.
AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable brute-force guessing of a valid code and bypass the intended second authentication factor, resulting in unauthorized account access.
The patch introduces per-user failed-OTP tracking, blocks verification after 30 failed attempts for one hour, clears the counter after a successful OTP verification, and provides administrator recovery actions to purge affected lockouts.