Cross‑Site Scripting allowed through the profile editing page or chat messaging component lets a remote attacker inject and run arbitrary script in a victim’s browser. The application lacks proper encoding or sanitization of user input, enabling session hijacking, credential theft, or additional downstream attacks. This weakness is a classic CWE‑79 case that can compromise user accounts entirely.

BeeHome MyBeeHome versions released before 2025‑11‑01 are affected. No specific sub‑versions are listed, so any build before that date may contain the flaw.

The vulnerability is exploitable via the web interface; a threat actor can submit malicious payloads without any local access. Although no EPSS score or KEV listing is provided, the remote XSS that permits code execution is inherently high‑risk. With no CVSS score supplied, the expected impact remains severe, and the attack vector is inferred to be remote web‑based.