OpenStack Skyline contains a DOM‑based Cross‑Site Scripting vulnerability caused by unsafe usage of document.write when rendering console logs. The flaw enables an attacker to inject and execute arbitrary JavaScript within the browser session of a logged‑in administrator, which could lead to credential theft, UI manipulation, or unauthorized actions against the OpenStack services.

All Skyline releases older than 5.0.1, 6.0.0, and 7.0.0 are affected. Administrators should verify the version running in their environment and plan an update accordingly.

The CVSS score of 5.4 indicates a moderate level of severity. EPSS information is not available and the vulnerability is not included in the CISA KEV catalog. Based on the description, the flaw requires an authenticated administrator who can access the console log view; no publicly available exploits are documented, so the ability to exploit depends on the administrator’s access and the visibility settings of the console.