Rucio, a framework for managing scientific data, contains a stored Cross‑Site Scripting flaw in the Custom Rules section of its WebUI. Attacker‑controlled input is saved in the backend and later rendered in the interface without proper escaping. This fault allows attackers to run arbitrary JavaScript in the browser context of any user who views the affected page, potentially enabling session cookie theft or other unauthorized actions within the Rucio system. The vulnerability corresponds to CWE‑79 (Cross‑Site Scripting) and CWE‑1004 (Insecure Data Sequence) and carries a CVSS score of 7.3.

All Rucio releases prior to 35.8.3, 38.5.4, and 39.3.1 are vulnerable. Users running any of these versions on the WebUI are at risk; installing 35.8.3, 38.5.4, or 39.3.1 (or later) resolves the issue.

The vulnerability is rated high with a 7.3 CVSS score, yet the EPSS score remains below 1% and the issue is not listed in the KEV catalog, indicating a low likelihood of widespread exploitation. The attack requires the ability to create a custom rule in the WebUI, which typically demands privileged access to the Rucio interface. Attackers could target the administrator or any user with that privilege to inject malicious content that will be rendered for other users who view the rule. While exploitation is possible, the low EPSS suggests that, in the current threat landscape, the risk is moderate but should not be ignored.