The vulnerability arises from RTIR's extension of RT's HTML scrubber, which permits any link containing the internal placeholder to pass through unchecked. This means that links using the javascript: scheme are not stripped and can be stored. An attacker who can add HTML content to a ticket—for example by sending an unauthenticated HTML email to the Incident Reports queue—can embed such a link. When a logged‑in user later clicks the link, the browser executes the JavaScript in the user's session, allowing the attacker to run arbitrary scripts with that user's authority. The flaw enables theft of session cookies, command execution within RT, and broader privilege escalation, compromising confidentiality, integrity, and availability of ticket data.

The affected product is Best Practical Solutions' RT for Incident Response. All installations that have RTIR installed before version 5.0.11 of the RTIR 5.x line or before version 6.0.4 of the RTIR 6.x line are vulnerable. The issue applies globally across the entire RT instance once RTIR is installed, not just to RTIR's own queues.

The CVSS score of 5.3 classifies the flaw as a medium severity vulnerability. The EPSS score is not available, which indicates insufficient publicly available exploitation data, but the default configuration that accepts HTML email from any sender makes the flaw readily exploitable by anyone. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely via the web interface or by sending crafted HTML email to the Incident Reports queue, enabling Cross‑Site Scripting that runs in the victim's session and can hijack credentials or masquerade as a legitimate user.