CVE-2026-1115

The vulnerability is located in the `create_post` function in the `backend/routers/social/__init__.py` file. User-supplied content is directly assigned to the `DBPost` model without any sanitization or input validation. Malicious JavaScript payload is permanently stored in the database and executed in the browser of every user viewing the main application feed. Due to the possibility of automatic attack propagation, the vulnerability may have a worm-like nature (wormable).

An attacker can cause account takeover of users and administrators, session hijacking, and wormable attacks, which are self-propagating attacks affecting subsequent users viewing infected content.

The lollms platform should be updated to version 2.2.0, where the issue has been resolved. The patch is available in the vendor references and in commit 9767b882dbc893c388a286856beeaead69b8292a in the GitHub repository.

All versions of parisneo/lollms prior to version 2.2.0.