The AIL Framework is vulnerable to a stored cross-site scripting flaw that allows an authenticated attacker to execute arbitrary scripts in the context of a victim's session.

The application fails to perform proper output encoding on dynamic values interpolated into the data-content attribute of Bootstrap popover elements within specific Jinja2 templates. An authenticated attacker can leverage this stored XSS vulnerability to inject malicious scripts that execute when a victim views the affected content.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code within the browser session of an authenticated user. This can lead to unauthorized actions performed on behalf of the victim, potential theft of session cookies, or the exfiltration of sensitive data displayed within the AIL Framework. Given the CVSS score of 8.5, this high-severity flaw poses a significant risk to the integrity and confidentiality of user sessions and managed data.

Immediate Action: Upgrade the AIL Framework to version 7.1 or later, which incorporates the necessary double HTML-escaping to neutralize the injection vector.

Proactive Monitoring: Review web application access logs for unusual patterns or suspicious payloads originating from authenticated user accounts.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS patterns.

Public Exploit Available: Unknown

Organizations utilizing the AIL Framework should prioritize the update to version 7.1 to mitigate this stored XSS risk. Because the vulnerability allows for the persistence of malicious payloads, failure to patch leaves the environment susceptible to ongoing session hijacking attempts. Immediate application of the vendor-provided security update is strongly recommended to protect user sessions and internal data integrity.