CVE-2026-1115 — CRITICAL (CVSS 9.6) AI Security Vulnerability

Q: Is CVE-2026-1115 actively exploited?

No confirmed active exploitation of CVE-2026-1115 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-1115?

1. Patch: Upgrade lollms to version 2.2.0 immediately — the fix implements input sanitization in the create_post function. 2. Workaround (if patching is blocked): Disable the social/post feature at the application level or restrict access to the Home Feed endpoint via network policy. 3. Detection: Review server-side logs for unusual POST requests to the social create_post endpoint containing HTML/script tags; audit existing posts in the database for stored payloads (search DBPost content for '<script', 'javascript:', 'onerror=', 'onload='). 4. Post-incident: If compromise is suspected, invalidate all active sessions, rotate any API keys or credentials accessible from the admin panel, and review access logs for unauthorized configuration changes.

Q: What systems are affected by CVE-2026-1115?

This vulnerability affects the following AI/ML architecture patterns: ML UI platforms, self-hosted AI assistants, shared LLM workspaces.

Q: What is the CVSS score for CVE-2026-1115?

CVE-2026-1115 has a CVSS v3.1 base score of 9.6 (CRITICAL).

CISO Take

A stored XSS vulnerability in lollms' social feature allows any unauthenticated user to inject persistent JavaScript into the Home Feed by posting unsanitized content, which executes in the browsers of every viewer — including administrators. With a CVSS of 9.6 and a wormable attack vector, a single malicious post can chain into full admin account takeover and cascade to every user who loads the feed; lollms has 8 prior CVEs in the same package, signaling a pattern of insufficient input validation in this codebase. No public exploit or CISA KEV listing yet, but the trivial exploitation barrier and admin impact make this high-priority. Upgrade to lollms 2.2.0 immediately; if upgrade is not possible, disable or restrict the social/post feature at the application or network level until patched.

Sources: NVD GitHub Advisory ATLAS huntr.com

Risk Assessment

Critical risk. CVSS 9.6 reflects network-accessible, low-complexity exploitation with no privileges required and high confidentiality/integrity/availability impact. The wormable nature — where a single injected post can harvest admin credentials and propagate — significantly multiplies blast radius beyond a typical stored XSS. lollms is a self-hosted AI UI platform commonly deployed by teams with internal access to LLM backends, model configs, and sensitive data. Compromise of an admin session gives attackers full control over the AI system, including model parameters, API keys, and user data. The pattern of 8 prior CVEs in this package lowers confidence in overall code quality.

Attack Kill Chain

Initial Access

Attacker registers or uses an existing low-privilege account on a lollms instance and submits a social post containing a JavaScript payload via the create_post API endpoint.

AML.T0049

Persistence via Storage

The malicious payload is stored unsanitized in the database through the DBPost model, persisting until an admin manually removes it.

Execution on Victim Browser

Any user — including admins — who loads the Home Feed triggers browser execution of the stored JavaScript without any further attacker interaction.

AML.T0011

Impact: Session Hijack & Worm

Admin session cookie is exfiltrated to attacker infrastructure; attacker gains full platform control and can modify existing posts to propagate the payload wormably to all remaining users.

AML.T0012

Initial Access

Attacker registers or uses an existing low-privilege account on a lollms instance and submits a social post containing a JavaScript payload via the create_post API endpoint.

AML.T0049

Persistence via Storage

The malicious payload is stored unsanitized in the database through the DBPost model, persisting until an admin manually removes it.

Execution on Victim Browser

Any user — including admins — who loads the Home Feed triggers browser execution of the stored JavaScript without any further attacker interaction.

AML.T0011

Impact: Session Hijack & Worm

Admin session cookie is exfiltrated to attacker infrastructure; attacker gains full platform control and can modify existing posts to propagate the payload wormably to all remaining users.

AML.T0012

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
lollms	pip	< 2.2.0	`2.2.0`
61 Pushed 7d ago 33% patched ~1d to patch Full package profile →

Do you use lollms? You're affected.

Severity & Risk

CVSS 3.1

9.6 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

Attack Surface

AV Network

AC Low

PR None

UI Required

S Changed

C High

I High

A High

Recommended Action

Patch: Upgrade lollms to version 2.2.0 immediately — the fix implements input sanitization in the create_post function.
Workaround (if patching is blocked): Disable the social/post feature at the application level or restrict access to the Home Feed endpoint via network policy.
Detection: Review server-side logs for unusual POST requests to the social create_post endpoint containing HTML/script tags; audit existing posts in the database for stored payloads (search DBPost content for '<script', 'javascript:', 'onerror=', 'onload=').
Post-incident: If compromise is suspected, invalidate all active sessions, rotate any API keys or credentials accessible from the admin panel, and review access logs for unauthorized configuration changes.

Classification

Code Execution Auth Bypass Data Extraction Framework API AML.T0011 - User Execution AML.T0012 - Valid Accounts AML.T0048.003 - User Harm AML.T0049 - Exploit Public-Facing Application AML.T0061 - LLM Prompt Self-Replication

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6 - Secure Development — Application Security

NIST AI RMF

MANAGE-2.2 - Manage AI Risks — Vulnerability Treatment

OWASP LLM Top 10

LLM02 - Insecure Output Handling

Frequently Asked Questions

What is CVE-2026-1115?

A stored XSS vulnerability in lollms' social feature allows any unauthenticated user to inject persistent JavaScript into the Home Feed by posting unsanitized content, which executes in the browsers of every viewer — including administrators. With a CVSS of 9.6 and a wormable attack vector, a single malicious post can chain into full admin account takeover and cascade to every user who loads the feed; lollms has 8 prior CVEs in the same package, signaling a pattern of insufficient input validation in this codebase. No public exploit or CISA KEV listing yet, but the trivial exploitation barrier and admin impact make this high-priority. Upgrade to lollms 2.2.0 immediately; if upgrade is not possible, disable or restrict the social/post feature at the application or network level until patched.

Is CVE-2026-1115 actively exploited?

No confirmed active exploitation of CVE-2026-1115 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-1115?

1. Patch: Upgrade lollms to version 2.2.0 immediately — the fix implements input sanitization in the create_post function. 2. Workaround (if patching is blocked): Disable the social/post feature at the application level or restrict access to the Home Feed endpoint via network policy. 3. Detection: Review server-side logs for unusual POST requests to the social create_post endpoint containing HTML/script tags; audit existing posts in the database for stored payloads (search DBPost content for '<script', 'javascript:', 'onerror=', 'onload='). 4. Post-incident: If compromise is suspected, invalidate all active sessions, rotate any API keys or credentials accessible from the admin panel, and review access logs for unauthorized configuration changes.

What systems are affected by CVE-2026-1115?

This vulnerability affects the following AI/ML architecture patterns: ML UI platforms, self-hosted AI assistants, shared LLM workspaces.

What is the CVSS score for CVE-2026-1115?

CVE-2026-1115 has a CVSS v3.1 base score of 9.6 (CRITICAL).

Technical Details

NVD Description

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the `create_post` function within `backend/routers/social/__init__.py`, where user-provided content is directly assigned to the `DBPost` model without sanitization. This allows attackers to inject and store malicious JavaScript, which is executed in the browsers of users viewing the Home Feed, including administrators. This can lead to account takeover, session hijacking, and wormable attacks. The issue is resolved in version 2.2.0.

Exploitation Scenario

An attacker identifies a lollms instance (internal or public) and registers or uses a low-privilege account. They submit a crafted social post containing a JavaScript payload — e.g., a script that exfiltrates document.cookie to an attacker-controlled server — via the create_post endpoint. Because lollms assigns user content directly to the DBPost model without sanitization, the payload is stored in the database. When an admin next loads the Home Feed, the browser executes the stored script, silently sending the admin's session cookie to the attacker. The attacker replays the session token to gain admin access to the lollms interface, extracts stored API keys and LLM configurations, and optionally modifies the original post or creates new posts to spread the payload wormably to remaining users — all without triggering obvious user-facing alerts.