GoFound version 1.4.1 contains a stored cross‑site scripting flaw that lets an unauthenticated attacker insert malicious script into the document text submitted to the /api/index endpoint. The search engine returns the stored content without escaping, and the administrator dashboard renders it with v-html, causing the script to execute in the browser of an administrator who performs a matching search. This allows the attacker to run arbitrary client‑side code within the privileged admin context.

The affected product is sea‑team’s GoFound running version 1.4.1. No other versions or products are identified as vulnerable.

With a CVSS base score of 5.1 the vulnerability is considered moderate. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker needs only network access to submit data to /api/index, after which an administrator’s use of the search feature triggers execution of the malicious script. Because the attack requires an administrator to run a search on the indexed entry, the likelihood of exploitation is constrained yet realistic in environments where the application is exposed to untrusted users and administrators frequently use the search function.