parisneo/lollms 在社交功能中存在存储型 XSS 漏洞

攻击者可以利用此 XSS 漏洞向 lollms 的社交功能中注入恶意 JavaScript 代码。当其他用户，包括管理员，浏览主页时，这些恶意代码会被执行。这可能导致攻击者窃取用户账户凭据，进行会话劫持，甚至执行更高级的攻击，例如蠕虫传播。攻击者可以利用这些恶意代码来窃取敏感信息，篡改用户数据，或控制整个系统。由于漏洞的严重性，攻击者可能能够完全控制受影响的系统。

Administrators of lollms instances are particularly at risk due to their elevated privileges. Users who actively participate in the social feature of lollms are also vulnerable, as they may be exposed to malicious JavaScript injected by other users. Shared hosting environments running lollms could be affected if multiple tenants share the same database and one is compromised.

• python / lollms: Examine the backend/routers/social/init.py file for the create_post function and ensure proper sanitization of user input before assigning it to the DBPost model. • generic web: Monitor access logs for suspicious POST requests to the create_post endpoint containing unusual JavaScript code. • generic web: Inspect the Home Feed page source code for any unexpected JavaScript code that might have been injected by an attacker.

1. 2026-04-10Disclosure

   disclosure

1. 已保留2026-01-17
2. 发布日期2026-04-10
3. EPSS 更新日期2026-04-17

为了缓解 CVE-2026-1115 的风险，建议立即升级到 lollms 2.2.0 或更高版本。如果无法立即升级，可以尝试以下临时缓解措施：严格审查用户提交的内容，实施输入验证和输出编码，使用 Web 应用防火墙 (WAF) 过滤恶意脚本，并定期扫描系统是否存在可疑活动。升级后，请确认漏洞已修复，可以通过尝试在社交功能中创建包含恶意 JavaScript 代码的帖子，并检查主页是否会执行该代码来验证。