Technical impact
The vulnerability is a stored cross‑site scripting flaw located in the "Notes" field of Checklists. An attacker can inject malicious scripts that are then displayed to any user who opens the checklist, allowing the attacker to run arbitrary code in that user’s browser with elevated privileges. The flaw could be exploited to hijack sessions, deface content, or exfiltrate data.
Affected Systems
The affected product is Cervantes, specifically versions prior to 1.4.0-beta. The advisory references Cervantes v1.3-beta as vulnerable and notes the fix was applied in 1.4.0-beta. No other vendors or product lines are listed.
Risk and Exploitability
The CVSS score of 6.8 indicates a medium severity vulnerability, yet the stored nature of the XSS suggests that any authenticated user who can create or modify checklist notes could place malicious content. EPSS data is not available, so precise exploitation likelihood is uncertain. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a web browser session, either through social engineering or by gaining access to a legitimate user account. If the Notes field is accessible to many users, the potential impact spans all users of that account group.
