The identified flaw is a cross‑site scripting vulnerability within the Secondary Index Handler of RethinkDB. Manipulation of the index metadata allows an attacker to inject arbitrary script code that is then returned to users who retrieve the affected metadata. The vulnerability can lead to the execution of malicious scripts in the browsers of legitimate users, potentially compromising the confidentiality and integrity of data transmitted by those browsers. This weakness is classified as CWE-79 and CWE-94.

All deployments of RethinkDB versions 2.4.3 and earlier are impacted. The flaw resides in the component that handles secondary index operations and therefore affects any installation that uses secondary indexes. No specific operating system or environment constraints are provided, so the risk applies broadly to all supported platforms for those product versions.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation has not been widely observed. A publicly available proof‑of‑concept demonstrates that the attack can be carried out remotely without authentication. Although the vulnerability is not currently listed in the CISA KEV catalog, the presence of a remote exploit and the lack of an official patch mean that deployments should be monitored, and remediation should be prioritized if a fix becomes available.