The vulnerability in the Lucy XSS filter precedes commit e5826c0 and results from improper sanitization due to misconfigured default superset rule files. This flaw, identified as CWE‑79, allows an attacker to inject malicious JavaScript that will execute in the victim’s browser. Such cross‑site scripting can be leveraged for phishing, cookie theft, and active content manipulation, posing risks to user confidentiality and application integrity.

Naver’s Lucy XSS filter, all versions released before commit e5826c0. The exact version range is not specified in the CVE data, so any instance of the filter that has not been updated to the fixed commit may be affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires the attacker to supply crafted input through a web form or HTTP request that is processed by the faulty XSS filter, taking advantage of the misconfigured superset rules to bypass sanitization.