The vulnerability allows an attacker to inject arbitrary HTML content into the internal web dashboard of DNSdist by sending specially crafted DNS queries. This cross‑site scripting flaw can be used to display malicious web pages within the dashboard interface, potentially leading to phishing or credential theft within the management console. The weakness is due to insufficient sanitization of input processed by the dashboard rendering component (CWE‑80).

The flaw affects PowerDNS DNSdist instances that have domain‑based dynamic rules enabled through DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI. No specific version numbers are supplied, so any release where these features are active may be impacted.

The vendor assigns a CVSS score of 3.1, indicating low impact, and the EPSS score is below 1 %, suggesting that exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to target a DNSdist server over the network and send crafted DNS queries that trigger the dynamic rule processing; thus, the attack vector is remote network. Since no publicly disclosed exploits are known, the current risk remains moderate but should be mitigated promptly.