The vulnerability is a reflected cross‑site scripting flaw in the DSpace JSPUI search filtering feature of Lyrasis DSpace 6.5. The flaw arises because the filter_type_1 parameter is not properly sanitized, allowing an attacker to inject JavaScript that executes in the victim’s browser when the search page is rendered. This can enable session hijacking, credential theft, or other malicious activities that compromise the confidentiality of user data. The weakness is a classic reflected XSS, classically identified as CWE‑79.

Any installation of Lyrasis DSpace 6.5 that exposes the JSPUI search/discover page with filtering capabilities is affected. The vulnerability resides in the default JSPUI component and does not require modification to the repository content or creation of special accounts. Users who load the search page with a crafted filter_type_1 value will be vulnerable.

With a CVSS base score of 6.1 the issue is classified as medium severity. An EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote: an attacker can craft a malicious URL containing a malicious filter_type_1 value, entice a target user to visit it, and achieve client‑side code execution without authentication or elevated privileges.