The vulnerability is a stored cross‑site scripting flaw in Rucio’s WebUI Custom RSE Attribute. Attackers can inject arbitrary JavaScript that is saved by the backend and later rendered without proper output encoding, enabling execution in the browser context of any user who views the affected page. This could lead to session token theft or other unauthorized actions.

Affected systems are installations of the Rucio framework that use versions earlier than 35.8.3, 38.5.4, or 39.3.1. The flaw resides in the handling of custom RSE attributes; any deployment relying on those legacy releases is vulnerable until a patched version is applied.

The CVSS score is 6.1, indicating moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is low, and the issue is not currently listed in CISA’s KEV catalog. The attack vector is via the WebUI, requiring the attacker to supply malicious input to the RSE attribute, which is then persisted and rendered for other users. Once the script runs, it operates with the privileges of the viewing user, potentially allowing credential compromise or other client‑side attacks.