This vulnerability is a reflected DOM‑based XSS flaw that lets an unauthenticated attacker inject arbitrary HTML into flash notifications on public pages. The frontend toast component renders that payload with innerHTML, so malicious code can execute in the browser context of any user who views the page. The flaw is a classic example of CWE‑80 and provides client‑side code execution.

The dataCycle‑CORE module of datacycle‑engine (dataCycle‑CORE) is affected in all releases up to and including 25.07.3. Any installation exposing public routes such as /docs is vulnerable, because the vulnerable JavaScript is loaded by the normal application layout.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can craft a link to a public page that contains malicious HTML in a flash notification; because authentication is not required, any user who visits the link will have the code executed in the context of the site.