The flaw is a reflected cross‑site scripting vulnerability that allows a remote attacker to inject AngularJS template expressions into an error page when requesting an unknown or unauthorized service URL. The unsanitized request content is rendered as an AngularJS template and, with known sandbox‑escape techniques, can be made to execute arbitrary JavaScript in the victim’s browser session. This is classed as an XSS weakness (CWE‑79) combined with improper neutralization of user input during client‑side rendering (CWE‑1336).

The issue affects GeoNetwork core‑geonetwork from version 3.0.0 through 4.2.14 and any 4.x release prior to 4.4.10. Versions 4.2.15 and 4.4.10 contain the fix, so systems running those or newer releases are not affected.

The vulnerability carries a CVSS score of 7.1, indicating a high‑severity security risk. No EPSS score is available, but the advisory indicates that exploitation requires an attacker to lure a user into opening a crafted link, which is a relatively high‑bar but still feasible attack vector. The CVE is not listed in the CISA KEV catalog, so no public exploits are currently known. In practice, an attacker could coerce an administrator or other authenticated user into clicking the link, leading to the execution of arbitrary JavaScript and the potential for data disclosure or the manipulation of the user’s authenticated session.