A cross‑site scripting flaw exists in SHIRASAGI that allows an authenticated attacker to inject and run arbitrary scripts in a user's web browser when the target accesses the web application. The injected code can steal session cookies, execute actions on behalf of the user, and potentially exfiltrate sensitive data. This vulnerability is classified as CWE‑79.

The vulnerability affects the SHIRASAGI project’s web application. No specific version numbers are listed, so all releases not yet addressing the flaw are potentially impacted.

The CVSS score of 5.1 indicates moderate severity. Because the flaw requires the attacker to be authenticated, an initial compromise or privileged user credentials are prerequisites for exploitation. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog, suggesting the likelihood of public exploitation is currently low. However, once authenticated, the attacker can run arbitrary client‑side code and hijack user sessions, which can lead to privilege escalation within the application and unauthorized data access.