The vulnerability is a DOM‑based cross‑site scripting flaw in Cribl Stream versions prior to 4.17.1. An authenticated user can be tricked into visiting a crafted URL that forces execution of arbitrary JavaScript in their browser. The flaw requires the victim to interact with the page, and the attacker can exploit it remotely via the malicious link. The CVSS score of 7.1 places the weakness in the moderate‑to‑high severity range, while the associated CWE identifiers include CWE‑20 and CWE‑79.

This issue affects Cribl Stream deployments from Cribl that are running any version earlier than 4.17.1. The vulnerability is present in all prior releases, so any such installation could be compromised unless the user upgrades to the fixed version.

The CVSS base score of 7.1 indicates that an attacker could cause moderate‑to‑high impact by compromising an authenticated user's browser session. The EPSS score of < 1% suggests a low probability of exploitation at present. The flaw is not listed in CISA KEV. The attack vector is remote, requiring an authenticated user to click a malicious link that exploits the DOM. Successful exploitation can lead to arbitrary script execution, potentially resulting in credential theft, session hijacking, or other malicious actions within the victim’s browser context.