# CVE-2026-1115: ParisNeo LoLLMs stored XSS in social feature

Source: https://junglewise.ai/threats/cve-2026-1115-parisneo-lollms-stored-xss-in-social-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-1115 · Severity: critical · CVSS 9.6 · Published 2026-04-10

A security vulnerability exists in the social networking feature of LoLLMs, a platform for large language models. Attackers can post malicious content that, when viewed by other users or administrators, executes hidden scripts in their web browsers. This could allow an attacker to take over user accounts, steal login sessions, or spread malicious activity across the platform.

Technologies: [Lollms](https://junglewise.ai/threats/technologies/lollms), [lollms (PyPI)](https://junglewise.ai/threats/technologies/pypi-lollms). Vendors: [Lollms](https://junglewise.ai/threats/vendors/lollms), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-1115 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1115 being exploited in the wild.

**How severe is CVE-2026-1115?** Critical severity, with a CVSS score of 9.6, published 10 April 2026.

**Which products and versions are affected?** lollms (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0.

**Is there a fix for CVE-2026-1115?** Yes. lollms (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1115 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1115?** Check whether you run Lollms or lollms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lollms (PyPI): upgrade to 2.2.0 or later

  ```sh
  pip install "lollms>=2.2.0"
  ```


## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the `create_post` function within `backend/routers/social/__init__.py` of the LoLLMs platform. The application fails to sanitize user-provided content before assigning it to the `DBPost` model and subsequently rendering it in the Home Feed. A remote, unauthenticated attacker can inject malicious JavaScript that executes in the context of any user viewing the feed, including administrators. This can lead to session hijacking, account takeover, and wormable attacks. The vulnerability is mitigated in version 2.2.0 by implementing input sanitization using the `bleach` library.

## Affected products

- parisneo lollms < 2.2.0

## Identifiers

- CVE-2026-1115
- GHSA-8wrq-fv5f-pfp2
- PYSEC-2026-401

## Timeline

- 2026-01-17: patched: Sanitization implemented in commit 9767b882dbc893c388a286856beeaead69b8292a
- 2026-04-10: disclosed
- 2026-04-10: advisory

## References

- [https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a](https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a)
- [https://huntr.com/bounties/099aa4fe-7165-4337-889c-3fb4f1aa71aa](https://huntr.com/bounties/099aa4fe-7165-4337-889c-3fb4f1aa71aa)

## Related threats

- [PYSEC-2026-1586 - Lollms has an Improper Access Control vulnerability](https://junglewise.ai/threats/cve-2026-1117-lollms-has-an-improper-access-control-vulnerability)
- [PYSEC-2026-1590 - Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function](https://junglewise.ai/threats/cve-2025-6386-lord-of-large-language-models-vulnerable-to-observable-discrepancy)
- [PYSEC-2026-1591 - LoLLMS Code Injection vulnerability](https://junglewise.ai/threats/cve-2024-6982-lollms-code-injection-vulnerability)
- [PYSEC-2026-1585 - Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py](https://junglewise.ai/threats/cve-2024-6971-lord-of-large-language-models-lollms-server-path-traversal)
- [PYSEC-2026-1587 - LoLLMS vulnerable to Expected Behavior Violation](https://junglewise.ai/threats/cve-2024-6281-lollms-vulnerable-to-expected-behavior-violation)