Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled `prompt_content` into `DBDirectMessage.content` without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through `MessageContentRenderer`, which uses `v-html` to insert rendered HTML into the DOM. The frontend sanitizer, which is regex-based, fails to comprehensively sanitize attacker-controlled HTML, allowing malicious payloads to execute in the victim's browser context. This vulnerability enables any authenticated user to send a malicious prompt-share message to another user's inbox, leading to arbitrary JavaScript execution, authenticated actions as the victim, exposure of same-origin application data, and potential account takeover.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-18 | 2 | Disclosure1General1 |
| 2026-07-19 | 1 | General1 |
It is possible to see elevated activities targeting parisneo lollms (CVE-2026-12228) https://vuldb.com/vuln/380097/cti
Post summary
The post notes increased activity observed against CVE‑2026‑12228 but provides no technical details, exploit code, or mitigation information.
🚨*CVE* CVE-2026-12228 A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-c… https://www.cve.org/CVERecord?id=CVE-2026-12228 ----- Traducción: CVE-2026-12228 Exi… http://infoflow.cloud`
Post summary
The post discloses a stored XSS flaw in the parisneo/lollms POST /api/prompts/share endpoint, providing specific technical details but no PoC, exploit, or patch information.
CVE-2026-12228 A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-c… https://www.cve.org/CVERecord?id=CVE-2026-12228
Post summary
The CVE describes a stored XSS flaw in a specific API endpoint of parisneo/lollms, but contains no PoC, exploit code, active exploitation claim, or remediation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lollms | lollms | - | - | - |