PyPI: lollms
CVE-2026-1115
Safety vulnerability ID: SFTY-20260410-24647
Safety legacy ID: pyup.io-92528
Affected versions of the lollms package are vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitisation of user-provided content in the social feature. The create_post function in backend/routers/social/init.py directly assigns user-supplied content to the DBPost model without sanitisation, allowing malicious JavaScript to be persisted and rendered in the Home Feed. An attacker can inject crafted JavaScript payloads via social posts, which execute in the browsers of other users including administrators, enabling session hijacking, account takeover, and wormable attacks.
Overview
parisneo/lollms vulnerable to stored XSS in the social feature
Advisory
Affected versions of the lollms package are vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitisation of user-provided content in the social feature. The create_post function in backend/routers/social/init.py directly assigns user-supplied content to the DBPost model without sanitisation, allowing malicious JavaScript to be persisted and rendered in the Home Feed. An attacker can inject crafted JavaScript payloads via social posts, which execute in the browsers of other users including administrators, enabling session hijacking, account takeover, and wormable attacks.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260410-24647/CVE-2026-1115
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1115
- https://data.safetycli.com/changelogs/lollms/
- https://github.com/advisories/GHSA-8wrq-fv5f-pfp2
- https://pypi.org/project/lollms
- https://nvd.nist.gov/vuln/detail/CVE-2026-1115
- https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a
- https://huntr.com/bounties/099aa4fe-7165-4337-889c-3fb4f1aa71aa
- https://github.com/advisories/GHSA-8wrq-fv5f-pfp2
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more