parisneo/lollms anfällig für gespeichertem XSS in der Social-Funktion

The XSS vulnerability in lollms arises from insufficient sanitization of user-provided content within the create_post function. Attackers can craft malicious JavaScript payloads and inject them into posts. When other users, including administrators, view the Home Feed, this injected script executes within their browsers. This enables attackers to steal session cookies, hijack user accounts, and potentially launch wormable attacks, spreading the malicious code to other users. The severity is amplified by the potential for administrator account compromise, granting attackers control over the entire lollms instance.

Administrators of lollms instances are particularly at risk due to their elevated privileges. Users who actively participate in the social feature of lollms are also vulnerable, as they may be exposed to malicious JavaScript injected by other users. Shared hosting environments running lollms could be affected if multiple tenants share the same database and one is compromised.

• python / lollms: Examine the backend/routers/social/init.py file for the create_post function and ensure proper sanitization of user input before assigning it to the DBPost model. • generic web: Monitor access logs for suspicious POST requests to the create_post endpoint containing unusual JavaScript code. • generic web: Inspect the Home Feed page source code for any unexpected JavaScript code that might have been injected by an attacker.

1. 2026-04-10Disclosure

   disclosure

1. Reserviert2026-01-17
2. Veröffentlicht2026-04-10
3. EPSS aktualisiert2026-04-17

The primary mitigation for CVE-2026-1115 is to immediately upgrade lollms to version 2.2.0 or later, which contains the necessary sanitization fixes. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious JavaScript payloads in the create_post endpoint. Thoroughly review and sanitize all user-provided input before storing it in the database. After upgrading, confirm the fix by attempting to create a post with a known malicious JavaScript payload and verifying that it is properly sanitized and does not execute when viewing the Home Feed.