CVE-2026-1115: Stored XSS in parisneo/lollms
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the DBPost model without sanitization. This allows attackers to inject and store malicious JavaScript, which is executed in the browsers of users viewing the Home Feed, including administrators. This can lead to account takeover, session hijacking, and wormable attacks. The issue is resolved in version 2.2.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1115?
CVE-2026-1115 is classified as a high severity Stored XSS vulnerability.
How do I fix CVE-2026-1115?
To mitigate CVE-2026-1115, upgrade to version 2.2.0 or higher of the parisneo/lollms software.
What impact does CVE-2026-1115 have on users?
CVE-2026-1115 allows attackers to inject malicious scripts, potentially compromising user data and session integrity.
Which versions of lollms are affected by CVE-2026-1115?
CVE-2026-1115 affects all versions of lollms prior to 2.2.0.
What component of lollms is vulnerable in CVE-2026-1115?
The vulnerability in CVE-2026-1115 is found in the `create_post` function within the social feature of lollms.