The Shynet analytics platform contains a cross‑site scripting flaw in the urldisplay and iconify template filters. The flaw allows a malicious URL or icon name supplied to these filters to inject script that will be executed when the page renders. The description implies that an attacker who can provide such a payload could cause the victim’s browser to execute arbitrary JavaScript in the context of the site.

All installations of Shynet produced by milesmcc that run a release prior to v0.14.0 are affected. No specific commit is listed, so any build before 0.14.0 should be considered vulnerable.

The CVSS score of 5.4 indicates medium severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is through a web page that renders URLs or icon names processed by the vulnerable filters, such as a dashboard or report that incorporates external or user‑supplied data.