AntSword’s noxss() sanitization flaw allows an attacker to inject arbitrary code through the jquery.terminal interface, leading to a one‑click remote code execution. The vulnerability combines a classic input validation weakness (CWE‑79) with an improper sanitization error (CWE‑1188) and code‑execution contamination (CWE‑94), permitting commands to run with the privileges of the AntSword process.

The cross‑platform AntSword website management toolkit is vulnerable in all releases prior to version 2.1.16. The flaw resides in the web console component that processes terminal commands; any deployment using an affected version and exposing the console can be compromised.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score is not publicly available, and it is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation so far. The likely attack vector is an authenticated user with access to the AntSword console, as the exploitation requires only a single click of an injected command; thus the risk of successful exploitation remains moderate to high for exposed or poorly secured deployments.