A flaw in the dmBaseLinkTag::text function of the diem project’s dmWidget component allows an attacker to supply arbitrary text that is rendered without proper escaping, resulting in a cross‑site scripting vulnerability. The flaw can be triggered remotely and the exploit code has already been released publicly. An attacker can inject malicious scripts into the output sent to users, potentially enabling session hijacking, phishing, or data exfiltration on the client side.

The vulnerability affects the diem application (diem-project:diem) across all releases, as the project employs a rolling release model and no specific fixed versions are available. Any deployment that uses the dmWidget component and its dmBaseLinkTag::text function is potentially exposed.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is not available, while the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote, and the exploit code is publicly available, meaning an attacker can target any exposed instance without local access. Since the authors of the project have not yet responded with a fix, the risk remains present until an official patch is applied.