Vulnerability Description
The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers (e.g., <img src=x onerror=alert(1)> or <svg onload=...>) in the tag name. When another authenticated user opened a page containing the tag selector, the malicious tag name was inserted into the DOM using jQuery's html property, causing the embedded script to execute in the victim's browser context. The vulnerable code paths affected both the suggestion/combo-item rendering (_renderComboItems) and the selected-tag rendering logic. In both cases, the display value derived from the tag's displayField was passed directly to the html property of a jQuery element constructor, which parses and inserts the string as raw HTML rather than as text. Preconditions: the attacker must have an authenticated account with permission to create custom tags, and the victim must be an authenticated user who views a page that renders the tag selector with the attacker's stored tag. The attack is stored (persistent) and does not require the victim to perform any action beyond loading the page. Security impact: successful exploitation allows arbitrary JavaScript execution in the victim's browser within the application's origin, potentially leading to session hijacking, unauthorized data access, form manipulation, or further client-side attacks.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-100174?
CVE-2026-100174 is a documented vulnerability. The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload cont...
How severe is CVE-2026-100174?
CVSS scoring is not yet available for CVE-2026-100174. Check NVD for updates.
Is there a patch for CVE-2026-100174?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.