Versions of Rucio before 35.8.3, 38.5.4, and 39.3.1 contain a stored cross‑site scripting flaw in the handling of RSE metadata within the WebUI. The flaw allows attacker‑controlled input to be persisted by the backend and subsequently rendered without proper output encoding, enabling the execution of arbitrary JavaScript in the context of users who view the affected pages. This could be used to steal session tokens or perform unauthorized actions on behalf of the user.

The vulnerability affects any installation of Rucio through its primary WebUI, specifically versions earlier than 35.8.3, 38.5.4, and 39.3.1. Users running those legacy releases are at risk if they allow arbitrary RSE metadata to be stored and displayed.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% signals a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning no exploits are currently known. An attacker would need to inject malicious payloads into RSE metadata and then persuade or force a legitimate user to view the modified page, after which the injected JavaScript would execute in the victim’s browser session.