Apache SkyWalking is vulnerable to an Improper Neutralization of Script‑Related HTML Tags in a Web Page, allowing stored Cross‑Site Scripting (XSS). Malicious code can be uploaded, saved, and later rendered in the user interface, enabling an attacker to create defacement pages, steal session cookies, or perform session hijacking. The weakness falls under CWE‑80 and can compromise the confidentiality and integrity of data viewed by any authenticated or unauthenticated user who loads the impacted page.

Apache Software Foundation’s Apache SkyWalking, versions up to and including 10.2.0, is affected by this stored XSS flaw. Upgrading to version 10.3.0 removes the vulnerability.

The CVSS score of 6.1 classifies the vulnerability as moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, leveraging web input fields that store user data without proper output encoding. While the risk is not exceptionally high, the impact of successful exploitation could undermine session security and user trust.