A flaw in rymcu forest, affecting all releases up to version 0.0.5, allows an attacker to inject arbitrary JavaScript into the UserInfoController updateUserInfo endpoint. The vulnerability is a classic reflected cross‑site scripting error coupled with a potential code execution weakness (CWE‑79 and CWE‑94). When exploited, malicious scripts are executed in the victim’s browser context, enabling session hijacking, credential theft, data modification, or defacement of the web interface.

The impacted product is rymcu forest. Versions through 0.0.5 are vulnerable, and no later releases have been listed as fixed. The vendor has not released a public patch or advisory, and the product’s vendor name is not widely recognized in major security feeds.

The CVSS score of 5.1 indicates a moderate level of severity, while the EPSS score of less than 1% signals a very low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog, suggesting it has not yet been exploited at scale. The attack vector is remote access via the web API; an attacker can craft a malicious payload and send it to the updateUserInfo endpoint, triggering script execution in any client that loads the reflected content.