Islandora suffers an improper neutralization of user‑supplied input during page rendering, allowing an attacker to inject malicious scripts that will execute in a victim’s browser. This Cross‑Site Scripting flaw can facilitate session hijacking, cookie theft, defacement, or the execution of arbitrary JavaScript in the context of a logged‑in user. The weakness is identified as CWE‑79 and carries a CVSS score of 5.4, indicating moderate severity.

Drupal Islandora versions 0.0.0 through 2.17.4 are affected. Users running these or earlier versions should consider upgrading.

The CVSS score of 5.4 reflects moderate risk. EPSS is below 1 %, suggesting limited exploitation activity in the wild; the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely involve an attacker crafting a malicious input—such as a URL parameter or form field—submitted to the vulnerable Islandora instance, which then fails to escape or validate the data. Because the flaw is purely client‑side, a remote attacker can trigger it by directing victims to a specially crafted link or by submitting malicious content that will later be rendered to other users.