CVE-2026-39416

CVE-2026-39416 is a stored cross-site scripting (XSS) vulnerability in the AIL framework, an open-source platform for collecting, crawling, and analyzing unstructured data. The vulnerability exists in versions prior to 6.8 and affects the modal item preview functionality, where items longer than 800 characters are returned without proper content-type headers, allowing browsers to interpret attacker-controlled content as executable HTML. The vulnerability carries a CVSS score of 6.1 (Medium severity) with a network-based attack vector requiring no special privileges but user interaction. The attack surface is notably broad due to its cross-site scope impact, though consequences are limited to low confidentiality and integrity breaches with no availability impact. The EPSS score of 0.00037 indicates this is a relatively uncommon vulnerability pattern compared to the broader CVE landscape. There is currently no evidence of active exploitation, and the vulnerability is not listed in the Known Exploited Vulnerabilities catalog. Community attention appears minimal, with an inactive status on tracking lists. However, organizations running AIL framework versions prior to 6.8 should prioritize upgrading to address this authenticated but high-impact risk to their analysis environment.