A flaw was discovered in the Horilla open‑source CRM (up to version 1.0.2) within the Leads module. The vulnerability lies in the static Assets JavaScript file global.js, where the Notes argument is not properly validated. An attacker can supply crafted input that is embedded into the page and executed by a browser, enabling the execution of arbitrary JavaScript code. This form of cross‑site scripting can lead to session hijacking, credential theft, defacement of content, or further lateral movement within the web application. The associated weaknesses are identified as CWE‑79 (XSS) and CWE‑94 (Code Injection).

The affected product is Horilla‑opensource Horilla CRM, versions up to and including 1.0.2. Affected files include static/assets/js/global.js in the Leads module. Updated release 1.0.3 contains the patch (commit fc5c8e55988e89273012491b5f097b762b474546).

The CVSS score of 5.1 indicates a moderate severity. The EPSS score of less than 1 % implies a very low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation. The attack can be carried out remotely by submitting malicious Notes content through the web interface. While the low EPSS indicates it is not heavily targeted, the remote nature of the exploit and potential impact on confidentiality, integrity, and availability warrant timely remediation.