The vulnerability is a stored cross‑site scripting flaw in the osctrl‑admin on‑demand query list, where a user with query‑level permissions can inject arbitrary JavaScript into the query parameter when running an on‑demand query. The injected payload is persisted and later executed in the browsers of any user who visits the query list page, including administrators. By chaining the script with CSRF token extraction, an attacker can elevate privileges and perform actions as the logged‑in user, potentially leading to full platform compromise if an administrator runs the payload.

jmpsec osctrl versions earlier than 0.5.0 are affected; only systems running the vulnerable version of osctrl and hosting the osctrl‑admin interface are at risk.

With a CVSS score of 6.1 the flaw is classified as medium severity. The EPSS score of fewer than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must possess query‑level permissions, which is the lowest privilege tier, to inject the malicious code; once injected, the script can affect all users who view the query list page.