The CVE describes an XSS vulnerability in the from_dict method of AppLollmsMessage in the ParisNeo/lollms project before version 2.2.0. The flaw arises because the content field is not sanitized or HTML‑encoded when deserializing user data, permitting an attacker to inject malicious JavaScript or HTML. When the payload executes in a victim’s browser, the attacker can hijack the session, take over the account, or launch wormable attacks that spread through other users.

Any deployment of ParisNeo/lollms older than version 2.2.0 is affected. The vulnerability resides in the AppLollmsMessage class within the lollms repository, and applies to installations that deserialize user‑provided message data via the from_dict method.

The CVSS score of 6.1 indicates a medium impact. The EPSS score of <1% suggests a low probability of exploitation. The vulnerability is remote and can be triggered by supplying crafted content over the network—most likely through HTTP requests or data import interfaces that call from_dict. Attackers need only supply malicious content; no privileged access is required, making exploitation straightforward for an attacker with network visibility. The lack of mitigation in the code means that an exploit will succeed on affected systems unless mitigated through patching or defensive filtering.