Azure Cosmos DB contains an improper neutralization of input during web page generation. This cross‑site scripting flaw allows an attacker to inject malicious scripts that are rendered in a web page context and executed by browsers of legitimate users, enabling the attacker to forge UI elements or impersonate other users. The vulnerability is identified as CWE‑79 and primarily threatens the integrity and trust of user interfaces rather than directly compromising data confidentiality or availability.

The affected product is Microsoft Azure Cosmos DB. No specific affected version ranges are listed in the advisory; administrators should verify that their deployment is running a version that has received the latest security update from Microsoft.

The CVSS score of 8.3 classifies this as a high‑severity vulnerability. The EPSS score of less than 1% suggests a very low likelihood of widespread exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker would need to send specially crafted input to Azure Cosmos DB that is subsequently reflected in a web page viewed by a user. Once the malicious script runs, the attacker can perform spoofing actions such as framing or deceiving users. Because the exploitation path requires network access to the database service, it is not trivially deployable but remains a serious risk for exposed instances.