AI Threat Alert
CVE-2026-12228: Lollms: stored XSS in prompt-share DM inbox
UNKNOWN CISA: ATTENDA stored cross-site scripting flaw in lollms lets any authenticated user embed malicious HTML/JavaScript inside a prompt-sharing direct message that executes in the recipient's browser the moment they open their inbox, because the backend never sanitizes prompt_content and the frontend's regex-based sanitizer can be bypassed. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template available yet, and the package shows zero tracked downstream dependents, so today's blast radius is confined to individual self-hosted deployments rather than a supply-chain-scale event. That said, the impact per victim is severe: arbitrary JS execution in the DM UI can perform authenticated actions on the victim's behalf, exfiltrate same-origin application data, and lead to full account takeover, and lollms already carries 10 other tracked CVEs, suggesting recurring input-handling weaknesses in this codebase. No patched version is referenced yet, so any multi-user lollms deployment should be treated as exposed until one ships. Immediate mitigation: disable or restrict the prompt-share/DM feature, replace the regex-based sanitizer with an allowlist HTML sanitizer (e.g. DOMPurify) or strip HTML entirely before rendering, add a strict Content-Security-Policy blocking inline scripts, and monitor `DBDirectMessage.content` inserts for `<script>`, `onerror=`, `javascript:` and similar injection markers.
What is the risk?
Moderate-to-high per-incident severity paired with currently low measured exploitation pressure. No CVSS/EPSS/KEV data exists to quantify likelihood, and there's no public PoC or Nuclei template, so opportunistic mass exploitation is unlikely today. However, exploitability is trivial for any authenticated user of a shared/multi-tenant lollms instance — the attack requires no special privileges beyond a normal account and no user interaction beyond opening a DM. Given lollms' history of 10 other CVEs and a package risk score of 36/100, the codebase shows a pattern of security debt that should raise scrutiny for any organization running it multi-user or internet-facing.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| LoLLMs | pip | — | No patch |
Do you use LoLLMs? You're affected.
How severe is it?
What should I do?
1 step-
1) Disable the prompt-share/DM feature until a patch is released, or restrict it to trusted admin-only accounts. 2) Replace the frontend regex-based sanitizer in MessageContentRenderer with a vetted allowlist HTML sanitizer (e.g., DOMPurify) applied on both write and render paths, or avoid v-html entirely for user-controlled content and render as plain text. 3) Add server-side sanitization/encoding on POST /api/prompts/share before persisting prompt_content to DBDirectMessage. 4) Deploy a strict Content-Security-Policy (no unsafe-inline, no unsafe-eval) to blunt any residual XSS. 5) Detection: monitor DB writes to DBDirectMessage.content for HTML/script markers (
<script,onerror=,javascript:,<img,<svg) and alert on anomalous outbound requests or DOM mutations from the DM thread view. 6) Track parisneo/lollms upstream for a fix and patch immediately once available — no patched version is currently referenced.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-12228?
A stored cross-site scripting flaw in lollms lets any authenticated user embed malicious HTML/JavaScript inside a prompt-sharing direct message that executes in the recipient's browser the moment they open their inbox, because the backend never sanitizes prompt_content and the frontend's regex-based sanitizer can be bypassed. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template available yet, and the package shows zero tracked downstream dependents, so today's blast radius is confined to individual self-hosted deployments rather than a supply-chain-scale event. That said, the impact per victim is severe: arbitrary JS execution in the DM UI can perform authenticated actions on the victim's behalf, exfiltrate same-origin application data, and lead to full account takeover, and lollms already carries 10 other tracked CVEs, suggesting recurring input-handling weaknesses in this codebase. No patched version is referenced yet, so any multi-user lollms deployment should be treated as exposed until one ships. Immediate mitigation: disable or restrict the prompt-share/DM feature, replace the regex-based sanitizer with an allowlist HTML sanitizer (e.g. DOMPurify) or strip HTML entirely before rendering, add a strict Content-Security-Policy blocking inline scripts, and monitor `DBDirectMessage.content` inserts for `<script>`, `onerror=`, `javascript:` and similar injection markers.
Is CVE-2026-12228 actively exploited?
No confirmed active exploitation of CVE-2026-12228 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-12228?
1) Disable the prompt-share/DM feature until a patch is released, or restrict it to trusted admin-only accounts. 2) Replace the frontend regex-based sanitizer in MessageContentRenderer with a vetted allowlist HTML sanitizer (e.g., DOMPurify) applied on both write and render paths, or avoid v-html entirely for user-controlled content and render as plain text. 3) Add server-side sanitization/encoding on POST /api/prompts/share before persisting prompt_content to DBDirectMessage. 4) Deploy a strict Content-Security-Policy (no unsafe-inline, no unsafe-eval) to blunt any residual XSS. 5) Detection: monitor DB writes to DBDirectMessage.content for HTML/script markers (`<script`, `onerror=`, `javascript:`, `<img`, `<svg`) and alert on anomalous outbound requests or DOM mutations from the DM thread view. 6) Track parisneo/lollms upstream for a fix and patch immediately once available — no patched version is currently referenced.
What systems are affected by CVE-2026-12228?
This vulnerability affects the following AI/ML architecture patterns: model serving / self-hosted LLM web UI, multi-user chat/DM messaging interfaces, agent frameworks (if lollms personas/agents are exposed via the same session).
What is the CVSS score for CVE-2026-12228?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011 User Execution AML.T0049 Exploit Public-Facing Application Compliance Controls Affected
What are the technical details?
Original Advisory
A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled `prompt_content` into `DBDirectMessage.content` without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through `MessageContentRenderer`, which uses `v-html` to insert rendered HTML into the DOM. The frontend sanitizer, which is regex-based, fails to comprehensively sanitize attacker-controlled HTML, allowing malicious payloads to execute in the victim's browser context. This vulnerability enables any authenticated user to send a malicious prompt-share message to another user's inbox, leading to arbitrary JavaScript execution, authenticated actions as the victim, exposure of same-origin application data, and potential account takeover.
Exploitation Scenario
An attacker registers or already holds a low-privilege account on a shared lollms instance. They craft a prompt_content payload containing an HTML/JS injection (e.g., an img tag with an onerror handler or an obfuscated script bypassing the regex filter) and call POST /api/prompts/share to send it as a direct message to a target user, such as an admin or a colleague with broader API-key access. When the victim opens their DM inbox, MessageContentRenderer renders the stored content via v-html without adequate sanitization, and the payload executes in the victim's authenticated browser session. The attacker's script then performs actions as the victim (e.g., changing settings, reading other conversations, extracting configured API keys) or exfiltrates same-origin data to an attacker-controlled endpoint, potentially escalating to full account takeover.
Weaknesses (CWE)
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
Timeline
Related Vulnerabilities
CVE-2026-1114 9.8 lollms: weak JWT secret allows admin takeover
Same package: lollms CVE-2026-1115 9.6 lollms: Stored XSS enables wormable account takeover
Same package: lollms CVE-2024-6982 8.4 lollms: RCE via eval() sandbox bypass in Calculate
Same package: lollms CVE-2026-1117 8.2 lollms: Access Control bypass enables privilege escalation
Same package: lollms CVE-2025-6386 7.5 lollms: timing attack enables credential enumeration
Same package: lollms