A vulnerability was discovered in the AIL Framework’s modal item preview feature that allows an attacker to embed malicious JavaScript in stored item content longer than 800 characters. Because the response was sent without a strict text/plain content‑type, the browser interprets it as active HTML, allowing the attacker to run arbitrary code within the context of any authenticated user who views the crafted item. The flaw is a classic stored cross‑site scripting weakness (CWE‑79).

The issue affects AIL Framework prior to version 6.8. Users running earlier releases of the open‑source platform are at risk, as the bug resides in the core preview rendering logic of the project named ail-framework, maintained by ail‑project.

The vulnerability carries a CVSS score of 8.5, indicating high severity, and is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data is unavailable, so the current exploit probability cannot be quantified. An attacker would need to supply content over 800 characters that contains malicious scripting and have an authenticated user retrieve that content via the preview modal, a scenario that is feasible in a web application context. The scope of impact extends to data confidentiality and integrity for any authenticated user who views the compromised item.