The vulnerability resides in the render_template function of the Machine‑Learning‑Web‑Apps Flask application, allowing users to inject malicious scripts via manipulated input. This flaw enables cross‑site scripting (XSS), classified as CWE‑79, and due to Jinja2’s code generation capabilities it also aligns with CWE‑94. When exploited, the attacker can execute arbitrary JavaScript in the browsers of any user who visits the affected page, potentially leading to credential theft, session hijacking, or defacement of web content.

Affected installations are those built from Jcharis:Machine‑Learning‑Web‑Apps at commit a6996b634d98ccec4701ac8934016e8175b60eb5 or earlier. Because the project adopts a rolling release model, explicit version numbers are not tied to releases; any deployment that has not been updated since that commit is potentially vulnerable.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is below 1%, suggesting low exploitation likelihood at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the exploit is publicly available and could be used by attackers. Attackers can target the application through its remote web interface, as the flaw exists in a publicly reachable endpoint. The lack of an official patch or workaround heightens the risk for environments that remain on older commits.