The vulnerability allows an attacker to inject arbitrary script code by manipulating the c argument in the standalone.html page of CesiumJS. This is a classic reflected Cross‑Site Scripting (XSS) flaw (CWE‑79) with elements of code injection (CWE‑94). An attacker who succeeds could execute malicious code in the context of the victim’s browser, potentially leaking data or performing actions on behalf of the user. The CVE description states the flaw can be triggered remotely and that a public exploit has already been released, increasing the risk of exploitation.

CesiumJS versions up to and including 1.137.0 are affected, specifically through the Apps/Sandcastle/standalone.html demo file. The vulnerability has not been confirmed in later releases, and the vendor has not released a patch as of the last advisory.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, which further implies limited known exploitation. However, the flaw is remote‑triggered via a crafted URL to standalone.html, and the availability of a public exploit means that, should the software remain unpatched, a successful attack is feasible.