The vulnerability allows an attacker with shared network access to inject arbitrary JavaScript into content loaded in a WebView component of the Joyland AI app. Injected scripts can read the system clipboard, issue arbitrary HTTP requests through the Weex 'stream' module, and read app‑internal storage. If the user has granted additional permissions to the app, the attacker can also read the entire file system, camera, microphone, and GPS data, which can lead to significant confidentiality or integrity violations.

The affected product is Joyland AI, provided by Joyland. The CNA data does not specify affected versions, so all installed instances of the application may be vulnerable.

The CVSS score of 9 indicates critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by leveraging shared network connectivity to deliver malicious payloads that trigger the WebView injection. The impact is system‑wide and poses a high likelihood of exploitation in environments where the app is installed and has network visibility.