CVE-2026-1115
Description
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the create_post function within backend/routers/social/__init__.py, where user-provided content is directly assigned to the DBPost model without sanitization. This allows attackers to inject and store malicious JavaScript, which is executed in the browsers of users viewing the Home Feed, including administrators. This can lead to account takeover, session hijacking, and wormable attacks. The issue is resolved in version 2.2.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
lollmsPyPI | < 2.2.0 | 2.2.0 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292anvdPatchWEB
- huntr.com/bounties/099aa4fe-7165-4337-889c-3fb4f1aa71aanvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-8wrq-fv5f-pfp2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-1115ghsaADVISORY
News mentions
0No linked articles in our index yet.