An Angular template injection flaw exists in the Reports feature of Nozomi Networks CMC and Guardian. An authenticated user with report privileges can embed a malicious Angular template, or a victim may be tricked into importing a compromised template. When the report is viewed or imported, the payload runs in the victim’s browser, potentially allowing the attacker to alter application data or impair application availability. Existing input validation and CSP measures block full XSS exploitation and direct data leakage, but the flaw still permits dangerous client‑side code execution.

The vulnerability affects Nozomi Networks CMC and Guardian software. Versions prior to 26.1.0 are affected; the precise version range is not explicitly listed, but the recommendation is to upgrade to v26.1.0 or later to address the issue.

The CVSS score of 5.1 indicates moderate severity, and no EPSS data is available, leaving the precise exploitation likelihood uncertain. The vulnerability is not included in the CISA KEV catalog. The attack requires an authenticated user with report privileges, meaning the threat is restricted to internal users or attackers who have compromised such accounts. However, social engineering could expand exposure. Once exploited, the risk is client‑side code execution with potential data modification or service disruption. Mitigation relies on upgrading the affected software.