A stored Cross‑Site Scripting flaw in the RustFS Console preview modal allows an attacker to inject and run arbitrary JavaScript within the console’s execution context. If a malicious payload is executed, it can read developer credentials that are saved in the browser’s localStorage, enabling the attacker to capture full administrator credentials and subsequently take over the account and compromise the system. Based on the description, it is inferred that the attacker injects malicious JavaScript into the preview modal and gains access to the browser context.

The bug affects all publicly released RustFS versions released before 1.0.0-alpha.83, including alpha 0 through alpha 82.

The vulnerability has a CVSS base score of 9.1, indicating a high‑severity potential. The EPSS score is < 1 %, showing that at the time of reporting the likelihood of exploitation is very low, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires that the attacker can open the console’s preview modal, which typically requires authenticated access, implying that the attack surface is limited to users who can log in to the RustFS console. Once the payload runs, the attacker can harvest stored credentials and gain full control of the administrative account, elevating the impact from a client‑side bug to a full system compromise. Based on the description, it is inferred that the attacker must have authenticated access to the RustFS console to successfully exploit the preview modal.