A stored cross‑site scripting flaw exists in the POST /api/prompts/share endpoint of Parisneo's lollms application. The endpoint accepts attacker‑controlled prompt_content, stores it into DBDirectMessage.content without server‑side sanitization, and later the message is rendered in the UI using v-html. Because the frontend sanitizer is regex‑based and incomplete, malicious HTML can be injected. The flaw allows any authenticated user to embed JavaScript that executes when a target opens the direct message, enabling arbitrary code execution in the victim’s browser context, authenticated actions on the victim’s account, and potential account takeover.

This issue affects the Parisneo lollms application (currently in its latest released version). Users of the application who rely on the Prompt Sharing feature and can send and receive direct messages are impacted. The vulnerability exists in the API endpoint handling shared prompts and in the client component that renders message content.

The vulnerability scores a CVSS of 8.7 and has a very low EPSS score of less than 1%. The likely attack involves an attacker creating a malicious prompt, sharing it via the Prompt Sharing endpoint, and then tricking a victim into opening the message thread. When the victim loads the content, the embedded script runs in the victim’s browser session, giving the attacker control over the web application domain and the victim’s authenticated session. While the exploitation probability appears low, the impact is substantial.