Cachet, an open‑source status page system, contains a stored Cross‑Site Scripting flaw in its incident creation form. An attacker who is authenticated to the system can inject arbitrary HTML or JavaScript that is persisted in the database and executed whenever the incident is displayed. Attackers may use the executed script to steal the victim’s session cookie or perform other malicious actions in the victim’s context, potentially leading to account takeover.

Cachet versions 2.4.1 and earlier are affected. The vulnerability exists in the incident component that handles user‑supplied content submitted through the creation form.

The CVSS score of 4.8 indicates a moderate impact. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting currently no widespread exploitation. Attackers must be authenticated to the system to use the flaw, but once authenticated they can target any user who views the compromised incident.