A cross‑site scripting vulnerability exists in Blossom when the Article Title field is processed by ArticleController.java in the Article Title Handler component. Input containing malicious scripts is not properly sanitized, allowing attackers to inject arbitrary JavaScript that executes in the context of a victim’s browser. Compromise could enable session hijacking, defacement, or execution of further client‑side attacks.

All installations of Blossom up to version 1.17.1 are affected. The vulnerable code resides in blossom-backend/backend/src/main/java/com/blossom/backend/server/article/draft/ArticleController.java, part of the Blossom backend package. Users running the Blossom web application in this version range must verify whether their deployment includes this component.

The CVSS score is 5.1, indicating moderate severity. The EPSS score is less than 1%, suggesting low known exploitation probability, and the issue is not listed in the CISA KEV catalog. However, the vulnerability is publicly disclosed and can be triggered remotely through normal use of the application, so the risk to systems that have not applied a fix remains moderate and active.