Vulnerability · Published Apr 10, 2026 · Assigned by @huntr_ai
CVE-2026-1115Stored XSS in parisneo/lollms
Critical 9.6
In plain English
A critical-severity cross-site scripting in parisneo/lollms from parisneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the `create_post` function within `backend/routers/social/__init__.py`, where user-provided content is directly assigned to the `DBPost` model without sanitization. This allows attackers to inject and store malicious JavaScript, which is executed in the browsers of users viewing the Home Feed, including administrators. This can lead to account takeover, session hijacking, and wormable attacks. The issue is resolved in version 2.2.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | lollms | 2.2.0 | GHSA-8wrq-fv5f-pfp2 |
| PyPI | lollms | 2.2.0 | PYSEC-2026-401 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parisneo | parisneo/lollms | unspecified – before 2.2.0 |
Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H