The AIL Framework was found to store attacker‑controlled data from crawler capture imports—item IDs, URLs and screenshot paths—directly into inline JavaScript on the showDomain page. This allows an attacker with write access to the API to embed arbitrary script in these fields. When a user loads the domain view, the script runs in the browser context, giving the attacker the ability to hijack the victim's session, exfiltrate data or perform unauthorized actions. The flaw is a stored XSS (CWE‑79).

The affected product is the AIL Framework developed by ail project. The vulnerability appears in the showDomain.html page. No specific version numbers are listed, so any release containing the vulnerable rendering logic that has not applied the listed fix is at risk.

The CVSS score is 6.3, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker first import a malicious capture via the API, which is a remote privilege that can be granted to users with a user‑role client. After the import, no further interaction is needed; any user who views the domain page will trigger the injected script. Use of the public API for imports is the primary attack vector.