{"action":"Upgrade lollms to 2.1.1 or later.","affected":[{"fixed":"2.1.1","introduced":"0"}],"component":"lollms","cve_ids":["CVE-2026-1116"],"ecosystem":"PyPI","epss":0.00258,"exploited":false,"fixed_versions":["2.1.1"],"id":"tcs_01M5KGY21J3AVKYC5PBPZ0YXFW","modified_at":"2026-07-13T07:15:27.796089674Z","published_at":"2026-04-12T03:16:07.600Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2200","https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a","https://huntr.com/bounties/d3d076a7-2a51-4e07-8d0e-91e28e76788e"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-2200","url":"https://osv.dev/vulnerability/PYSEC-2026-2200"}],"summary":"A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of"}