An attacker who can manipulate the output of a host check can inject untrusted JavaScript into Synthetic Monitoring HTML logs. This flaw is an instance of improper input neutralization (CWE‑79) and can lead to arbitrary script execution when users view the logs. The injected code can be used in a crafted phishing link to compromise user credentials or perform other malicious actions.

The vulnerability affects Checkmk releases 2.4.0 and earlier versions prior to patch 2.4.0p22, and releases 2.3.0 and earlier versions prior to patch 2.3.0p43. The affected vendor is Checkmk GmbH and the product name is Checkmk.

The CVSS score of 7.3 indicates a high‑severity flaw, while the EPSS score of less than 1% suggests that the likelihood of widespread active exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can modify host check output—typically requiring privileged or local access. Once the payload is injected, the flaw can be abused via a crafted phishing link that delivers the malicious JavaScript to any user who views the Synthetic Monitoring logs.