Is CVE-2026-1116 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1116 being exploited in the wild.

How severe is CVE-2026-1116?

Medium severity, with a CVSS score of 6.1, published 12 April 2026.

Which products and versions are affected?

lollms (PyPI) ECOSYSTEM:introduced=0,fixed=2.1.1.

Is there a fix for CVE-2026-1116?

Yes. lollms (PyPI): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1116 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-1116?

Check whether you run Lollms or lollms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1116: ParisNeo LoLLMs XSS in AppLollmsMessage from_dict method

CVE-2026-1116 · Severity: medium · CVSS 6.1 · Published 2026-04-12

A security vulnerability exists in LoLLMs, an open-source platform for Large Language Models. The software fails to properly clean user-provided message content, allowing an attacker to inject malicious scripts that execute in other users' browsers. This could lead to unauthorized access to user accounts, session hijacking, or the spread of malicious code within the platform.

Technologies: Lollms, lollms (PyPI). Vendors: Lollms, PyPI.

Quick answers

Is CVE-2026-1116 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1116 being exploited in the wild.
How severe is CVE-2026-1116?: Medium severity, with a CVSS score of 6.1, published 12 April 2026.
Which products and versions are affected?: lollms (PyPI) ECOSYSTEM:introduced=0,fixed=2.1.1.
Is there a fix for CVE-2026-1116?: Yes. lollms (PyPI): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1116 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1116?: Check whether you run Lollms or lollms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lollms (PyPI): upgrade to 2.1.1 or later
```
pip install "lollms>=2.1.1"
```

Technical details

A stored Cross-site Scripting (XSS) vulnerability exists in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The root cause is a failure to sanitize or HTML-encode the `content` field during the deserialization of user-provided data. An unauthenticated remote attacker can exploit this by providing a crafted dictionary containing malicious HTML or JavaScript payloads. When this content is rendered in a victim's browser, the script executes in the context of the application's origin, potentially leading to session hijacking or account takeover. The issue was addressed in version 2.2.0 by integrating the `bleach` library for input sanitization.

Affected products

parisneo lollms < 2.2.0

Identifiers

CVE-2026-1116
PYSEC-2026-2200

Timeline

2026-01-17: patched: Fix committed to repository
2026-04-12: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.