PatchSiren

parisneo CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH parisneo CVE published 2026-07-18

CVE-2026-12228

CVE-2026-12228 is a stored cross-site scripting (XSS) vulnerability in the `POST /api/prompts/share` endpoint of parisneo/lollms. The endpoint stores attacker-controlled `prompt_content` into `DBDirectMessage.content` without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through `MessageContentRenderer`, which uses `v-html` to insert ren [truncated]