The vulnerability arises because nice‑select2 renders options supplied through the <select> element directly into the DOM without sanitization. An attacker can inject malicious JavaScript that is executed when a user visits or interacts with a page that uses the affected component. This client‑side code execution can lead to data theft, session hijacking, defacement, or further attacks such as credential phishing or malware delivery, thereby compromising the confidentiality, integrity, and availability of the affected web application.

The flaw exists in the open‑source JavaScript library nice‑select2, affecting all releases prior to version 2.4.1. Any web application that incorporates this library and populates the select component with user‑controlled or untrusted data is susceptible.

The CVSS score of 5.3 indicates a moderate severity flaw. The EPSS score of less than 1% suggests the probability of exploitation is low at this time, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply data that is rendered by the component, which typically means the vulnerability is exploitable in the context of a user interacting with a vulnerable page rather than from a remote network vector. Nevertheless, because the attack triggers client‑side code, the outcome can be severe if the user is running privileged or sensitive sessions.