The vulnerability occurs in the LockerProject Locker 0.0.0/0.0.1/0.1.0 component. By manipulating the ID argument passed to the authIsAwesome function in source-code/Locker-master/Ops/registry.js, an attacker can inject arbitrary scripts that are executed in the victim’s browser. This constitutes a classic Cross‑Site Scripting (CWE‑79) flaw. One malicious script could persist across pages, steal session cookies, or perform client‑side phishing. The flaw is a client–side code injection that can be exploited remotely without authentication.

Affects LockerProject Locker in all reported releases: 0.0.0, 0.0.1, and 0.1.0 as identified by the vendor. No other versions have been confirmed to be unaffected in the supplied data.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation cases to date. The attack can be performed remotely by sending a crafted request that forces the server to include attacker‑controlled content in its error response. Exploit code is publicly available in the source repository, so an attacker who can deliver the crafted request (e.g., via a site that calls Locker’s APIs) can trigger the XSS immediately.