This flaw is caused by missing HTML escaping when cluster data is written into reports. An attacker with cluster‑administrator rights can insert malicious JavaScript into objects such as the ClusterVersion spec.channel field, which is then rendered into a victim’s browser when the report is opened. The result is a stored XSS attack that can hijack user sessions, exfiltrate credentials, or otherwise compromise the client environment.

Red Hat Pen Drive Powered by Red Hat Lightspeed versions prior to 1.0.0-2 are affected. All releases that include the unescaped rendering logic, including the cpe versions 0 and 1 listed by Red Hat, fall under the risk window. The vulnerability is only exploitable in environments where the cluster cluster objects.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting a lower current exploitation probability. Exploitation requires privileged cluster manipulation and the victim to open the generated HTML report in a browser. The attack vector is effectively controlled by the cluster administrator, but once the report is viewed the malicious code executes without further privileges.