CVE-2026-12228 Overview
CVE-2026-12228 is a stored cross-site scripting (XSS) vulnerability in the POST /api/prompts/share endpoint of parisneo/lollms. The endpoint persists attacker-controlled prompt_content into DBDirectMessage.content without server-side sanitization. The direct message UI then renders the stored payload through MessageContentRenderer, which uses Vue's v-html directive to inject HTML into the DOM. A regex-based frontend sanitizer fails to neutralize crafted HTML, allowing scripts to execute in the victim's browser context [CWE-79].
Critical Impact
Any authenticated user can deliver a malicious prompt-share message that executes arbitrary JavaScript in the recipient's session, enabling authenticated actions as the victim, same-origin data exposure, and potential account takeover.
Affected Products
- parisneo/lollms (latest version at time of disclosure)
- Direct Message subsystem using MessageContentRenderer
- Prompt sharing feature exposed via POST /api/prompts/share
Discovery Timeline
- 2026-07-18 - CVE-2026-12228 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-12228
Vulnerability Analysis
The flaw is a classic stored XSS chain spanning the API layer and the frontend renderer. When a user calls POST /api/prompts/share, the server accepts prompt_content from the request body and writes it directly into the content field of DBDirectMessage. No HTML escaping, allowlist filtering, or output encoding is applied on the server side.
When the recipient opens their inbox, the DM thread loads the stored message and hands the raw content to MessageContentRenderer. That component uses Vue's v-html directive, which assigns to innerHTML and parses the string as HTML. Any <script> tag, event-handler attribute, or SVG-based vector present in the payload becomes live DOM.
A regex-based sanitizer runs on the client, but pattern-matching cannot reliably parse HTML. Attackers bypass it with mixed-case tags, malformed attributes, nested constructs, or obscure event handlers, so malicious markup survives into the render path.
Root Cause
The root cause is missing server-side output-neutralization combined with unsafe client-side rendering. Trusting user input at both boundaries and relying on a regex sanitizer violates the principle of defense in depth for HTML contexts [CWE-79].
Attack Vector
Exploitation requires low-privilege authenticated access to the lollms instance and user interaction from the victim, who must open the direct message. An attacker crafts an HTML payload with an event handler or scriptable element, submits it as prompt_content via POST /api/prompts/share addressed to the victim, and waits for the DM to be opened. Because the scope changes from attacker to victim inside the shared origin, the CVSS scope is marked as changed. Refer to the Huntr Bounty Report for technical proof-of-concept details.
Detection Methods for CVE-2026-12228
Indicators of Compromise
- Rows in the DBDirectMessage table where content contains <script, onerror=, onload=, javascript:, or <svg substrings.
- POST /api/prompts/share requests with prompt_content bodies containing HTML tags or JavaScript URI schemes.
- Outbound HTTP requests from browser sessions to attacker-controlled hosts shortly after a user opens a DM thread.
Detection Strategies
- Instrument the /api/prompts/share route to log and alert on payloads containing HTML control characters or scriptable attributes.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline-script violations originating from DM views.
- Hunt historical DM records for stored payloads that match known XSS patterns before deploying a fix.
Monitoring Recommendations
- Monitor authentication and session activity for anomalous actions performed by users immediately after DM interactions.
- Alert on unexpected API calls issued from browser sessions that correlate with viewing shared prompts.
- Track error telemetry for CSP violations, unusual fetch/XMLHttpRequest origins, and DOM mutation spikes on DM pages.
How to Mitigate CVE-2026-12228
Immediate Actions Required
- Disable or gate the POST /api/prompts/share endpoint until a patched build is deployed.
- Purge existing DBDirectMessage rows containing HTML or scriptable content to prevent delayed exploitation.
- Force re-authentication and rotate session tokens for users who may have opened untrusted shared prompts.
Patch Information
At time of publication, no fixed version identifier is listed in the NVD entry. Track the upstream parisneo/lollms repository and the Huntr Bounty Report for the remediation commit. Apply the fix as soon as it is released and verify that both server-side sanitization and safe client-side rendering are present.
Workarounds
- Replace v-html in MessageContentRenderer with text interpolation, or route content through a vetted HTML sanitizer such as DOMPurify with a strict allowlist.
- Enforce server-side sanitization on prompt_content before persisting to DBDirectMessage.content, rejecting or escaping HTML entirely.
- Deploy a strict Content Security Policy that forbids unsafe-inline scripts and restricts script-src to trusted origins.
# Example CSP header to mitigate stored XSS execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
