Threats tagged 'ghsa-8rfq-f9pf-jjm3'

AIL Framework versions up to 7.0.0 contain a stored cross-site scripting (XSS) vulnerability in the crawler domain view. This flaw allows an attacker to inject malicious JavaScript into stored URLs that are later embedded unsafely into a JavaScript onclick handler. Exploitation requires an authenticated analyst to interact with the malicious screenshot entry, potentially enabling session information access or unauthorized actions within the application context. The vulnerability is due to improper input neutralization and was fixed by applying Jinja's tojson filter to safely escape the URL before insertion.