The vulnerability arises from the html rendering function within the Version Check Service component of diem. Malicious input supplied to this function can cause the web application to output user‑supplied content without proper sanitization, allowing attackers to inject arbitrary JavaScript. If an attacker can reach the affected endpoint, they can execute scripts in the context of any user who views the page, potentially enabling session hijacking, data theft, or defacement. This is a typical cross‑site scripting flaw (CWE‑79). The description also lists CWE‑94, suggesting potential code execution via eval or similar, however the provided text only mentions XSS, so the primary impact is script injection.

The affected product is diem by diem‑project. The vulnerability exists in releases up to the commit hash 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. The project uses a rolling release model and has not published a fixed version, so any deployment that includes the vulnerable commit remains at risk.

The CVSS base score is 4.8, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation is possible according to the advisory, but the lack of tooling or widespread reports means exploitation likelihood is uncertain. Attacks would require sending crafted requests to the Version Check Service and a compromised or vulnerable user to execute the injected script.