JavaMelody versions before 1.60.0 contain a reflected cross‑site scripting vulnerability that allows an unauthenticated attacker to inject and execute arbitrary JavaScript by supplying a crafted value in the graph parameter of the /monitoring?part=graph endpoint. The supplied value is only JavaScript‑escaped in HtmlCounterReport, and an attacker can close a script tag to cause script execution in the victim’s browser. This flaw permits attackers to hijack user sessions, steal personal data, or perform other malicious actions in the context of the victim’s session.

All deployments of JavaMelody 1.x and earlier that have the monitoring feature enabled. Versions older than 1.60.0 are affected; upgrading to 1.60.0 or later resolves the flaw.

The vulnerability has a CVSS score of 5.1, indicating moderate impact. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog, suggesting limited public exploitation to date. The attack vector is through a standard HTTP request to the monitoring endpoint with a crafted graph parameter, implying that any user with access to the monitoring page (even unauthenticated) could trigger the vulnerability.