A stored cross‑site scripting flaw was discovered in the social module of lollms. The create_post routine saves user input directly into the database without sanitization, allowing an attacker to embed malicious JavaScript that is later rendered in the browsers of anyone who views the home feed, including administrators. This enables session hijacking, account takeover and potentially wormable attacks, as the injected script runs with the privileges of the victim user. The weakness aligns with CWE‑79.

The vulnerability affects the lollms application developed by parisneo. Any installation of the product with a version earlier than 2.2.0 is impacted. Updates to version 2.2.0 and onward contain the fix.

The CVSS score of 9.6 signals a very high severity, reflecting the extensive impact on confidentiality, integrity, and availability of user sessions. Although EPSS data is unavailable, the clear attack path—an attacker creating a post that gets stored and later viewed—suggests that exploitation is straightforward for authenticated users. The vulnerability is not listed in CISA’s KEV catalog, but its high score and the ability to self‑propagate make it a critical risk for exposed installations.