OSCAL‑GUI includes a reflected cross-site scripting vulnerability that allows attackers to inject malicious JavaScript via the project parameter in oscal-forms.php. The code assigns the URL‑decoded value to a variable without sanitization and, when the ID is not found, concatenates the unsanitized input into an error message that is reflected in the HTML response. This flaw can be leveraged to run arbitrary scripts in the context of the victim’s browser, potentially leaking session cookies, defacing the page, or executing further client‑side attacks.

The affected product is OSCAL‑GUI from brian‑ruf. No explicit version information is supplied in the advisory, so all current releases of this application may be vulnerable until a fix is applied.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a malicious link containing a crafted project parameter and convincing victims to load that URL, after which arbitrary JavaScript runs in the victim’s browser.