OpenSift’s chat interface renders stored user or model content using unsafe HTML interpolation. The flaw allows an attacker who can insert data into study, quiz, or flashcard items to embed malicious scripts that are executed later when another authenticated user views that content. The vulnerability is a stored XSS that can lead to arbitrary code execution inside the victim’s browser session, potentially letting the attacker perform actions on behalf of the user. The weakness aligns with CWE‑116 (Improper Encoding) and CWE‑79 (Cross‑Site Scripting).

OpenSift’s AI study tool is affected in all releases up to and including 1.1.2‑alpha. The problem has been corrected in version 1.1.3‑alpha and later. Users running earlier versions should treat the application as vulnerable whenever they store or display untrusted content in the chat UI.

The issue carries a CVSS score of 8.9, indicating high severity, while the EPSS score is below 1 %, suggesting a low probability of widespread exploitation at the time of analysis. It is not listed in CISA’s KEV catalog. The attack requires the attacker to supply malicious content that is stored by the system and then viewed by a victim during an authenticated session. Once the payload is rendered, it runs with the privileges of the victim, allowing the attacker to manipulate the local app session and potentially exfiltrate data or perform unauthorized actions.