A stored cross‑site scripting vulnerability resides in the renderDrawer function of the /system/dict/data/add endpoint of y_project RuoYi up to version 4.8.3. By manipulating the cssClass argument, an attacker can inject arbitrary script that will be executed in the browser of any user who views the affected page. This flaw can facilitate theft of session cookies, credential exfiltration, or other client‑side attacks.

The issue affects y_project RuoYi, specifically versions up to and including 4.8.3. No other versions have been identified as vulnerable.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the weakness can be triggered from a remote source, an attacker with internet connectivity can exploit it without local privileges. The vulnerability’s impact is primarily confidentiality and integrity of user sessions, with potential for data disclosure and defacement. Due to the absence of mitigations in the affected releases, exploitation remains feasible as soon as the vulnerable code is reachable.