The vulnerability stems from the RabbitMQ management UI failing to properly escape user-supplied vhost names. An attacker can inject arbitrary HTML or JavaScript that will be processed and rendered when the UI is accessed. This allows the execution of malicious scripts in the browser context used by administrators or other users, potentially leading to session hijacking, credential theft, or broader compromise of the affected system.

Any RabbitMQ Server instance running versions 3.7.0 up to and including 4.0.12 or any 4.1.x series prior to 4.1.2. The affected component is the management HTTP interface that renders vhost information.

With a CVSS score of 5.6 the vulnerability is rated as moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker who can create or modify vhost names in RabbitMQ can inject malicious payloads that will run in any browser that visits the management UI. Successful exploitation can allow the attacker to execute arbitrary JavaScript with the privileges of the UI user, facilitating further compromise of the broker environment.