A stored Cross‑Site Scripting flaw in the RustFS Console allows an attacker to inject and execute arbitrary JavaScript when the preview modal is rendered. Because the payload runs in the context of the management console, it can read sensitive data such as administrator credentials that are kept in browser localStorage, enabling full control of an administrative account. The vulnerability is a CWE‑79 type flaw.

All published RustFS versions prior to 1.0.0‑alpha.83 are affected. This includes alpha releases from alpha1 through alpha82 and any earlier builds that match the provided CPE strings.

The vulnerability carries a CVSS base score of 9.1, denoting a high severity risk. The EPSS score of 4% indicates a low but non‑zero probability of exploitation. It is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker must gain access to the RustFS console – the preview logic is only invoked for logged‑in users – though it is not explicitly stated. If successful, the attacker can harvest stored credentials and achieve full account takeover, turning a client‑side defect into a full system compromise.