Mercator is an open‑source mapping application that allows authenticated users to create and edit system entities. The vulnerability arises from the use of unescaped Blade directives (``{!! !!}``) in the display templates, which means that any JavaScript injected into a field such as "contact point" is rendered directly into the page without filtering. When an entity containing such a payload is viewed, the script runs in the browser of any user who opens the page, including administrators. This can lead to cookie theft, session hijacking, data exfiltration, or other malicious actions that compromise confidentiality and integrity. The weakness is classified as CWE‑79: Cross‑Site Scripting.

The affected product is Mercator, released by dbarzin. All versions prior to 2026.02.22 contain the flaw; version 2026.02.22 and later contain the fix. No specific vendor product names beyond "Mercator" are listed.

The CVSS base score of 8.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests current exploitation probability is low, and the issue is not yet listed in the CISA KEV catalog. The attack vector is inferred to be malware injection by an authenticated user with the User role; this user can add malicious code to entities, which then propagates to every user who views the affected page. The high score and broad reach within the user community mean that this vulnerability poses a significant risk to affected deployments, especially where privileged users can create or edit entities.