Helpy 2.8.0 includes a stored cross‑site scripting vulnerability in the rendering logic of the knowledge base Doc body. An authenticated attacker who possesses admin or agent editor roles can persist arbitrary HTML or JavaScript within a Doc’s body field. The injected payload is then served to any user who views that Doc, enabling the attacker to steal session cookies, deface the site, or conduct other client‑side attacks.

The affected product is Helpy by helpyio, specifically version 2.8.0. The vulnerability is present across all supported operating systems (Linux, macOS, Windows) as indicated by the corresponding CPE entries.

The vulnerability has a CVSS score of 4.8, placing it in the moderate severity range. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Because the attack requires authenticated privileges, exploitation is limited to users who already have admin or agent editor rights; nonetheless, once compromised, the attacker can affect any user who views the injected Doc.