Vulnerability · Published Apr 12, 2026 · Assigned by @huntr_ai
CVE-2026-1116Cross-site Scripting (XSS) in parisneo/lollms
High 8.2
In plain English
A high-severity cross-site scripting in parisneo/lollms from parisneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` field when deserializing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads, which can be executed in the context of another user's browser. Exploitation of this vulnerability can lead to account takeover, session hijacking, or wormable attacks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | lollms | 2.1.1 | PYSEC-2026-2200 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parisneo | parisneo/lollms | unspecified – before 2.2.0 |
Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N