The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames into the DOM using D3's html() method in the tooltip. Because the username value (d.obj) is interpolated directly into an HTML string without sanitization, a crafted username containing HTML event handlers (e.g., <img src=x onerror=alert(1)>) will execute arbitrary JavaScript in the analyst's browser when the analyst hovers over the corresponding timeline entry. The attack requires the victim to be an authenticated analyst with access to the timeline view and to interact with the malicious timeline entry (hover). Successful exploitation can lead to session hijacking, data exfiltration, or unauthorized actions performed within the analyst's authenticated session. The vulnerability resides in the client-side JavaScript file var/www/static/js/d3/timeline_basic.js.
" } ], "value": "The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames into the DOM using D3's html() method in the tooltip. Because the username value (d.obj) is interpolated directly into an HTML string without sanitization, a crafted username containing HTML event handlers (e.g.,The fix applies the existing sanitize_text() helper to the user-controlled username value (d.obj) immediately before it is interpolated into the D3 tooltip HTML string. This ensures that any HTML or script content embedded in the stored username is neutralized before DOM insertion, preventing script execution while preserving the tooltip's intended formatting (line breaks and date/time display).
" } ], "value": "The fix applies the existing sanitize_text() helper to the user-controlled username value (d.obj) immediately before it is interpolated into the D3 tooltip HTML string. This ensures that any HTML or script content embedded in the stored username is neutralized before DOM insertion, preventing script execution while preserving the tooltip's intended formatting (line breaks and date/time display)." } ], "title": "Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip", "x_gcve": [ { "extensions": { "bcp-05-x-01": { "ai_annotations": [ { "ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [ { "gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama" } ], "review_status": "none", "scope": "record", "tags": [ "ai-computer-assisted:llm-generated", "ai-computer-assisted:classification" ] } ] }, "bcp-05-x-02": { "x_patch2vuln": { "assumptions": [ "The UI:A (Active) user interaction metric assumes the analyst must deliberately hover over the specific timeline entry to trigger the XSS; passive rendering without hover is not evidenced in the patch.", "The affected version boundary is inferred from the tag_version_boundary metadata (v7.1, 29 commits after fix); the exact last affected and first fixed version numbers are not explicitly stated in the patch.", "PR:N assumes the attacker does not need an account on the AIL Framework itself, only a presence in a crawled chat or forum source; if the platform requires the attacker to be a registered user to have their username crawled, PR:L might be more appropriate.", "The CAPEC-1 mapping is the closest available pattern for stored XSS; no more specific CAPEC ID for 'stored XSS via imported data rendered in a tooltip' exists in the CAPEC catalog.", "The sanitize_text() helper is assumed to perform adequate HTML entity encoding or equivalent neutralization; its implementation is not shown in the patch.", "VC:H and VI:H reflect the sensitivity of an intelligence-analysis platform where an authenticated analyst session may contain classified or highly sensitive data; if the deployment context is less sensitive, lower impact ratings could apply." ], "capecRationale": [ { "capecId": "CAPEC-1", "rationale": "CAPEC-1 describes the general pattern of injecting client-side scripts into web pages via untrusted input. The patch evidence shows a stored username (untrusted input from chats/forums) being rendered into an HTML tooltip without sanitization, matching the stored-XSS sub-pattern of CAPEC-1. This is the closest and most direct CAPEC mapping for an XSS vulnerability where attacker-controlled data is persisted and later rendered in a victim's browser." } ], "commit": "455dd92c4179c53204368d93681ded4b57e31643", "confidence": "medium", "credits": [ { "lang": "en", "type": "remediation developer", "value": "terrtia" } ], "cvssRationale": "AV:N: The vulnerability is in a web application accessible over the network. AC:L: The attacker only needs to craft a username with HTML/JS in a chat or forum that gets crawled; no race conditions or complex conditions are needed. AT:N: No attack on the target system is required; the malicious username is stored as part of normal data import. PR:N: The attacker does not need any account or privilege on the AIL Framework; they only need to be a user in a source chat/forum. UI:A: The victim (analyst) must actively hover over the specific timeline entry to trigger script execution. VC:H: XSS in an authenticated analyst session can expose sensitive intelligence data, session tokens, and credentials. VI:H: The attacker can perform actions as the analyst, modify data, or exfiltrate information. VA:N: No impact on availability. SC/SI/SA:N: No subsequent system impact is evidenced.", "fixSummary": "The fix applies the existing sanitize_text() helper to the user-controlled username value (d.obj) immediately before it is interpolated into the D3 tooltip HTML string. This ensures that any HTML or script content embedded in the stored username is neutralized before DOM insertion, preventing script execution while preserving the tooltip's intended formatting (line breaks and date/time display).", "generatedAt": "2026-09-25T13:24:29.029450Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": { "rankings": [ { "agreementScore": 9, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 4 } ], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required." }, "patchSha256": "36262636a3a75bbee1ac4f863ce7a5ce7939eb2e21fed5ede98403d38c29ec40", "patchSummary": "In var/www/static/js/d3/timeline_basic.js, the single line constructing the tooltip HTML was changed from tooltip.html(`${d.obj}