CVE-2026-1115criticalCWE-79

CVE-2026-1115: critical vulnerability in parisneo/lollms

Stored XSS in parisneo/lollms

Published

Follow this CVE+ Monitor parisneo/lollms+ Monitor lollms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.6epss 1.3%
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the `create_post` function within `backend/routers/social/__init__.py`, where user-provided content is directly assigned to the `DBPost` model without sanitization. This allows attackers to inject and store malicious JavaScript, which is executed in the browsers of users viewing the Home Feed, including administrators. This can lead to account takeover, session hijacking, and wormable attacks. The issue is resolved in version 2.2.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
parisneo · parisneo/lollms
Related CVEs — parisneo/lollms

In the same product, most dangerous first.

CVE-2024-3429CRITICALPath Traversal in parisneo/lollmsEPSS 28.3%CVE-2026-0558HIGHUnauthenticated File Upload in parisneo/lollmsEPSS 2.0%CVE-2026-0560HIGHServer-Side Request Forgery (SSRF) in parisneo/lollmsEPSS 1.8%CVE-2024-5443CRITICALRemote Code Execution via Path Traversal in parisneo/lollmsEPSS 1.2%CVE-2024-4315CRITICALLFI Vulnerability due to Lack of Path Sanitization in parisneo/lollmsEPSS 1.0%CVE-2024-4078CRITICALArbitrary Code Execution in parisneo/lollmsEPSS 0.9%