The vulnerability is an improper neutralization of input during web page generation in yacy_search_server. An attacker can inject malicious JavaScript through HTTP requests, causing a web browser to execute that script in the context of an authenticated user. This can lead to theft of session cookies, unauthorized actions, or defacement of the site. The weakness is a classic input‑validation flaw described by CWE‑79.

The affected product is the yacy_search_server component of the yacy project. No specific version information is noted in the CVE entry, so any deployment of this component could be affected unless a later release has applied the fix.

Based on the description, the likely attack vector is remote via HTTP requests to the YaCyDefaultServlet. The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of being seen in the wild. The vulnerability is not listed in CISA’s KEV catalog. The exploitation path relies on remote input via web requests to the YaCyDefaultServlet. Successful exploitation requires that the attacker can deliver crafted requests to the vulnerable server, which is generally available over the public internet.