# CVE-2026-100190: AIL Framework stored XSS in showDomain page

Source: https://junglewise.ai/threats/cve-2026-100190-the-ail-framework-crawler-splash-domain-page-showdomain-html-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100190 · Severity: info · Published 2026-09-25

AIL Framework is a web-based platform for analyzing internet content through automated crawling and data collection. A stored cross-site scripting vulnerability in the domain display page could allow an attacker with API access to inject malicious JavaScript into captured data, which executes when any user views the affected domain page, potentially enabling session hijacking or unauthorized actions.

Technologies: [Ail-Project AIL framework](https://junglewise.ai/threats/technologies/ail-framework). Vendors: [Ail-Project](https://junglewise.ai/threats/vendors/ail-project).

## Quick answers

**Is CVE-2026-100190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100190 being exploited in the wild.

**How severe is CVE-2026-100190?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** AIL Project AIL Framework.

**Is there a fix for CVE-2026-100190?** A patch was published on 2026-09-24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100190 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100190?** Check whether you run Ail-Project AIL framework. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Stored XSS vulnerability in the showDomain.html template where user-supplied data from crawler capture imports (item IDs, URLs, screenshot paths) is directly interpolated into inline JavaScript contexts and HTML attributes without escaping. An attacker with API client credentials can craft a malicious crawler capture containing JavaScript payloads that persist in the application's data layer and execute in any user's browser when the domain page is rendered, requiring no additional user interaction.

## Affected products

- AIL Project AIL Framework

## Timeline

- 2026-09-25: disclosed
- 2026-09-24: patched

## References

- [https://github.com/ail-project/ail-framework/commit/31376ee3d04519c898bb9b3671453a41c4117340](https://github.com/ail-project/ail-framework/commit/31376ee3d04519c898bb9b3671453a41c4117340)

## Related threats

- [AIL Framework Onion module crawler task injection](https://junglewise.ai/threats/cve-2026-100187-the-onion-module-in-ail-framework-contained-a-performance)
- [AIL Framework insufficient authorization in crawler task API](https://junglewise.ai/threats/cve-2026-100177-the-ail-framework-crawler-task-creation-api-api-add-crawler-task)
- [AIL Framework stored XSS in username timeline tooltip](https://junglewise.ai/threats/cve-2026-100176-the-ail-framework-s-username-timeline-feature-is-vulnerable-to)
- [AIL Framework stored XSS in tag selector component](https://junglewise.ai/threats/cve-2026-100174-the-ail-framework-tag-selector-component-var-www-static-js-tags)
- [AIL Framework stored XSS in Jinja2 templates](https://junglewise.ai/threats/cve-2026-100172-the-ail-framework-ail-project-ail-framework-contains-a-stored)