The vulnerability resides in the /courses/<course_id>/assignments/<assignment_id>/submissions/html_content route, where content from student‑submitted HTML files is rendered without sanitization. Attackers can embed malicious scripts that execute in the browser of any instructor who views the affected submission, potentially hijacking their session or exfiltrating sensitive data. This is a classic stored XSS flaw (CWE‑79).

MarkUsProject’s Markus application, versions prior to 2.9.1. The vulnerability is fixed in v2.9.1. No other versions are confirmed affected.

The CVSS base score of 8.0 classifies this as a high‑severity flaw. The EPSS score of less than 1% indicates a low probability of exploitation at present, and it has not been listed in CISA’s KEV catalog. Attackers can exploit the flaw by submitting a crafted assignment as a student and later tricking an instructor into opening that submission; no privileged access is required beyond the ability to view the page.