This vulnerability is an improper neutralization of user‑supplied input during web page generation in Drupal Quick Edit. The flaw allows malicious JavaScript to be embedded in views rendered by the module, which could execute in the browser of anyone who accesses the affected content. The weakness is formally categorized as CWE‑79.

The affected component is the Drupal Quick Edit module. All releases before 1.0.5, including the initial 0.0.0 launch, and all releases before 2.0.1 are vulnerable. Users of any earlier versions should verify whether they expose the module to the front‑end or other accessible interfaces.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score is reported as under 1 %, suggesting low current exploitation activity. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is exploitation via the Quick Edit interface, which requires an authenticated user with edit privileges to inject the malicious payload. Based on the description, it is inferred that the injected script can run in the context of any user who views the edited content, potentially allowing them to perform unauthorized actions in that user’s browser.