jivejdon contains a stored cross‑site scripting flaw in its default‑enabled TextStyle filter, where unvalidated URLs are inserted directly into anchor href attributes. Authenticated users can post messages that include javascript: links or quote‑breaking URLs. When another user views the message, the embedded JavaScript executes on the client side.

The affected product is jivejdon as delivered by banq. The vulnerability is present in the code base from commit 595d8d22 up to commit ee67a65e. Users running this codebase without an updated version that removes or corrects the TextStyle filter are impacted.

The CVSS score of 5.1 indicates a medium severity of the stored XSS issue. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified and may be low or moderate. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must be authenticated users of the application to post the malicious payload, and the vulnerability manifests when other users view the stored link. The compromised clients can run arbitrary JavaScript in the context of the application domain.