This vulnerability arises from improper neutralization of input in the ilpFilter field on nLegacy.jsp of Juniper Networks Junos Space. An attacker can inject script tags into that field; when another user loads the resulting page, the injected script runs with that user’s permissions, potentially allowing the elevation of privileges up to an administrator. The impact is the execution of arbitrary client‑side code, which can be abused for malicious actions such as session hijacking, data exfiltration, or further compromise of the affected system.

Juniper Networks Junos Space prior to release 24.1R5 Patch V3 is affected. All earlier versions of Junos Space contain the vulnerable ilpFilter field.

The CVSS score of 5.1 designates moderate severity, and the attack vector is a reflected XSS in a web interface. Based on the description, it is inferred that the attacker must supply a crafted link or form with the malicious payload, and a user with valid session credentials must subsequently visit that link for the exploit to succeed. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of widespread exploitation remains uncertain, but the ability to gain administrator‑level code execution warrants prompt remediation.