A function called append in the Administrative Console module accepts the dm_command argument without proper sanitization, allowing an attacker to inject arbitrary HTML or JavaScript payloads that are subsequently rendered by the browser. The vulnerability is a classic reflected or possibly stored cross‑site scripting flaw, which can be triggered by a remote actor and is publicly exploitable. In the CWE formalism this is identified as CWE‑79 while the direct use of user input in execution paths also maps to CWE‑94.

The affected product is diem‑project: diem. All commits up through 116974edfb9a5b8bd69cb13586dc62bcdbb485ad contain the vulnerable code. Because diems rolling‑release model does not publish discrete version numbers, a specific version upgrade that removes the flaw is presently unknown.

The CVSS score of 4.8 indicates a low overall risk. The vulnerability can be triggered remotely by providing a crafted dm_command parameter to the Administrative Console. No EPSS score is available and the issue is not listed in the CISA KEV catalog. An attacker must supply a malicious dm_command payload; successful exploitation would result in client‑side code execution when the page renders the unfiltered input.