Rucio exhibits a reflected XSS flaw in the rendering of the ExceptionMessage on 500 error pages. By causing a specific exception and delivering a maliciously crafted URL, an attacker can inject script that runs in the victim’s browser and reads the login session cookie. This vulnerability is a classic reflected input problem (CWE‑1004) and a classic reflected XSS (CWE‑79), allowing an attacker to hijack a user’s authenticated session and gain unauthorized access to data.

The issue impacts the Rucio framework produced by CERN, the software that manages large scientific datasets. Versions that are older than 35.8.3, 38.5.4, and 39.3.1 contain the flaw and are therefore vulnerable. The affected releases are used in large research collaborations that rely on Rucio for data access.

The CVSS v3.1 base score of 8.1 indicates high severity. EPSS indicates a very low exploitation probability (<1%), and it is not listed in the CISA KEV catalog. The attack requires remote access to the WebUI via a crafted URL and depends on the victim having an authenticated session; the craft is delivered through HTTP GET or POST. With these prerequisites, an attacker could exfiltrate session tokens and impersonate the user, compromising both confidentiality and integrity of sensitive scientific data.