A cross‑site scripting weakness in the rrweb‑snapshot JavaScript library allows an attacker to construct a custom payload that is interpreted as executable script or markup when the library processes it. The vulnerability is classified as CWE‑79 and can lead to arbitrary code execution within the context of a victim’s browser session, potentially enabling theft of credentials, session hijacking, or defacement of content. The impact is limited to the user’s browser environment and does not directly affect the server or other users without the crafted payload.

The flaw exists in rrweb‑snapshot prior to version 2.0.0‑alpha.18. All deployments that incorporate the library from the GitHub contributors list that reference older releases are potentially affected. No vendor-specific product licensing is listed, as the library is open‑source and distributed via GitHub.

The CVSS score of 6.1 indicates moderate severity, and the CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no known widespread exploitation. The EPSS score is not available, so the precise likelihood of attack remains uncertain. Attackers would most likely deliver a crafted payload through a stored or reflected input that is captured by rrweb‑snapshot and then rendered in a victim’s browser. Without an attack surface that triggers the library’s vulnerable path, exploitation is unlikely, but the presence of the flaw allows for significant damage if such an input path exists.