Trudesk before version 1.2.12 includes a server‑side JavaScript injection flaw that lets an authenticated user insert arbitrary code into the MongoDB $where clause via the tickets search API. By closing the regular expression in the GET /api/v1/tickets/search request, an attacker can cause the database to execute a tight loop that exhausts resources, resulting in a denial of service, or retrieve the complete ticket documents, exposing internal notes and other sensitive data. This is a direct impact on confidentiality and availability because the attacker can read sensitive information and interrupt normal service operation.

The affected products are Trudesk, developed by polonel, in all releases up to and including 1.2.11. The vulnerability exists for any deployment that exposes the API to authenticated users.

The CVSS score is 7.1, indicating a high severity vulnerability. This flaw corresponds to CWE‑943, server‑side JavaScript injection. No EPSS score is available, and the issue is not listed in CISA KEV. The attack vector requires authenticated access to the API, so users with valid credentials can exploit the flaw. Exploitation is relatively straightforward: submit a crafted search query with a malicious $where expression. Once triggered, the system may become unresponsive or leak confidential data.