The vulnerability allows group titles and descriptions to contain arbitrary JavaScript. When displayed in the Sakai web interface, the malicious code runs in the context of the user’s browser, potentially enabling session hijacking, credential theft, or other client‑side attacks.

The Sakai Collaboration and Learning Environment is affected. Versions between 23.0 and 23.4, and between 25.0 and 25.1, are vulnerable due to improper handling of group metadata.

The CVSS base score is 1.3 and the EPSS score is below 1 %. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires creating or editing group titles or descriptions via the web UI, suggesting that privileged or authenticated users with group‑management permissions can provide the malicious content. Because the exploit is client‑side, the primary risk is to users who view the affected group pages. Overall risk remains low, but the potential impact to end users can be significant if the XSS payload is crafted to steal credentials.