An authenticated LinkAce user can inject a payload that breaks the XML CDATA wrapper in the Atom feed endpoint for lists. The attacker’s payload closes the CDATA block, injects a native SVG element with an onload handler, and causes the browser’s XML parser to execute arbitrary JavaScript when the feed URL is opened. The script runs in the victim’s browser context, allowing attacker‑controlled code execution, data theft, or defacement. The vulnerability is limited to the Atom feed rendering context and does not allow arbitrary remote code execution on the server side.

Kovah:LinkAce, versions 2.4.2 and earlier are affected. The flaw was addressed in version 2.4.3 and later.

The flaw has a CVSS score of 8.7, reflecting high client‑side impact. The EPSS score is below 1%, suggesting that exploitation attempts are rare but not impossible. The issue is not listed in the CISA KEV catalog. A successful exploit requires an authenticated user to inject the payload; the script will then execute in any browser that fetches the Atom feed, including the attacker’s own. Thus the attack surface is moderate but the potential damage to users’ browsers is high.