The vulnerability is a stored cross‑site scripting flaw in Checkmk 2.5.0 beta releases prior to 2.5.0b2. It allows authenticated users who have permission to create hosts or services to insert arbitrary JavaScript into host or service names. When other users perform searches in the Unified Search feature, the unescaped name is rendered, and the embedded script executes in their browsers.

Checkmk GmbH’s Checkmk product, specifically the 2.5.0 beta version before 2.5.0b2. The affected build identifiers include 2.5.0:b1 and all earlier 2.5.0 beta releases as listed by the CNA.

The CVSS base score of 8.6 indicates high severity, while an EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a user account with host or service creation rights; the attacker must authenticate and then supply specially crafted host or service names that are rendered without proper escaping in the Unified Search results. The impact is arbitrary JavaScript execution in the browsers of other users who view the search results.