Stored XSS in modal item preview for long item content in AIL Framework

AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in 6.8.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

AIL framework 跨站脚本漏洞

AIL framework是ail project开源的一个模块化信息泄露分析框架，用于分析来自非结构化数据源的潜在信息泄漏。 AIL framework 6.8之前版本存在跨站脚本漏洞，该漏洞源于模态项预览功能存在存储型跨站脚本，可能导致在已验证用户查看特制项时执行任意JavaScript。

N/A

N/A