A reflected cross‑site scripting flaw in the Graylog Web Interface console allows an attacker to inject arbitrary JavaScript code through unsanitized URL segments that are echoed back in the response. The vulnerability is rooted in a lack of proper output encoding and enables the attacker to execute scripts in the victim browser, potentially hijacking the browser session or manipulating the session context via the '/system/nodes/' endpoint.

Graylog provides a Web Interface component, with the vulnerable release identified as 2.2.3. Users running Graylog Web Interface version 2.2.3 are affected.

The CVSS base score of 5.3 marks the vulnerability as moderate in severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker crafts a malicious URL containing the injected JavaScript and lures a victim into visiting that URL. Upon visit, the victim’s browser will execute the script, granting the attacker limited control over the session context but not full system compromise.