Stored XSS in Direct Messages via Unsanitized Prompt Content

A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled `prompt_content` into `DBDirectMessage.content` without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through `MessageContentRenderer`, which uses `v-html` to insert rendered HTML into the DOM. The frontend sanitizer, which is regex-based, fails to comprehensively sanitize attacker-controlled HTML, allowing malicious payloads to execute in the victim's browser context. This vulnerability enables any authenticated user to send a malicious prompt-share message to another user's inbox, leading to arbitrary JavaScript execution, authenticated actions as the victim, exposure of same-origin application data, and potential account takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

A stored cross-site scripting (XSS) vulnerability in parisneo/lollms allows attackers to inject malicious scripts through the `/api/prompts/share` endpoint. The vulnerability exists because the `prompt_content` parameter is stored directly in the database without server-side sanitization, and subsequently rendered using `v-html` in the frontend's MessageContentRenderer component. This bypasses the regex-based client-side sanitizer, enabling persistent script execution whenever a victim views the compromised direct message. Organizations and individual users of lollms are affected, with impact ranging from session hijacking and credential theft to lateral movement within shared workspace environments.

Casky's skill mapping to TA0001 (Initial Access) and TA0043 (Reconnaissance) identifies the attack chain: adversaries can craft malicious prompts to establish persistence in shared message threads, then leverage those interactions for information gathering and trust establishment with victims. Using Claude AI with extended reasoning, practitioners analyzing findings would detect suspicious patterns such as JavaScript tags or event handlers embedded in `DBDirectMessage.content` entries, abnormal rendering behavior in message threads, and discrepancies between stored content and sanitization logs. The 322 mapped skills enable detection across input validation failures (CWE-79), DOM manipulation risks, and authentication bypass attempts that typically follow successful XSS exploitation. Practitioners would see alerts flagging unvalidated HTML content, failed sanitization events, and unusual DOM modifications—critical indicators for this vulnerability class.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12228.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-12228

Casky has 322 skills that investigate the attack patterns behind CVE-2026-12228. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn