The vulnerability in Jexactyl allows arbitrary script execution through a stored DOM cross‑site scripting flaw. Server‑side JSON objects are injected directly into a Blade template using an unescaped JSON helper, causing user‑controlled string values to break out of the JavaScript context. When a page containing the affected template is rendered, the embedded script runs in the victim’s browser, providing an attacker with full control over that session and the ability to manipulate or exfiltrate data. This weakness is consistent with CWE‑79, which covers cross‑site scripting flaws.

Jexactyl installations, particularly versions 4.0.0. For the 4.0.0 series, all beta releases (4.0.0 beta1 through beta7) and release candidates (4.0.0 rc1 and rc2) are affected. Any prior release of Jexactyl that includes the vulnerable template code prior to commit e28edb204e80efab628d1241198ea4f079779cfd is also impacted. The issue was fixed in the referenced commit and therefore any version newer than that commit is considered safe.

The CVSS score of 5.8 indicates moderate theoretical severity, while an EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, further supporting low public exploit activity. The attack vector, inferred from the description, is client‑side browser execution triggered by normal loading of a Jexactyl page. An attacker must first supply malicious content into a server‑side field that is later JSON‑encoded, such as a username, display name, or site configuration value. Once the vulnerable page is viewed by any authenticated or unauthenticated user, the malicious script will execute in that user’s browser context.