Sickbeard through build-507 contains a reflected cross‑site scripting vulnerability that enables unauthenticated attackers to inject malicious JavaScript into victim browsers via the pattern parameter of the /config/postProcessing/testNaming endpoint. By crafting a GET request that includes a malicious SVG onload payload, an attacker can cause the testNaming handler to return the payload unescaped, leading to execution of arbitrary client‑side code in the victim’s browser. This can enable cookie theft, session hijacking, or other CSRF‑style attacks originating from the victim’s context.

The vulnerability impacts the midgetspy Sickbeard application, specifically build-507. Only users running this particular build are affected; later builds are presumed unaffected if the issue has been patched.

The CVSS score of 5.1 indicates moderate risk. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting limited observed exploitation. The likely attack vector is a client‑side crafted URL that an authenticated or unauthenticated user may be tricked into following, which enables reflected script execution. The absence of a need for privileged access or remote code execution reduces the severity compared to higher‑tier flaws, but the impact on user sessions and data remains significant.