A flaw in the MyEMS Admin Backend SVG endpoint enables malicious data to be stored in the 'data' the SVG is viewed. This issue, located in the on_post function of myems-api/core/svg.py, stems from improper validation of new_values['data']—an example of CWE‑79 (Cross‑Site Scripting) and a related CWE‑94 (Command Injection). The vulnerability permits remote attackers to inject arbitrary script that runs in the browser context of any user who accesses the compromised SVG.

All installations of MyEMS running versions up to and including 6.4.0 are susceptible. The issue was fixed in the 6.5.0 release, which replaces the vulnerable handling with properly sanitized input processing. No other vendors or products are listed as affected.

The CVSS score of 4.8 indicates a moderate risk. The EPSS score of < 1% indicates that exploitation is currently unlikely, but the vulnerability can be triggered over the network by submitting crafted POST data to the vulnerable endpoint. Because the vulnerability can be triggered remotely, it poses a threat to any publicly accessible MyEMS administration interface that has not been patched.