Arcane, an interface for managing Docker containers, exposed a reflected XSS flaw in the GET /api/app-images/logo endpoint. The color query parameter is substituted directly into an SVG <style> block without escaping, allowing an attacker to close the style element and inject executable <script> code. When an authenticated administrator views the crafted URL, the malicious JavaScript runs in Arcane’s origin context and can read the HttpOnly JWT cookie, granting full control of the admin account. This constitutes a true account takeover scenario.

The vulnerability affects versions of the Arcane application from getarcaneapp:arcane prior to 1.19.0. Any deployment running a build older than 1.19.0 is vulnerable; later versions include the fix for the color sanitisation and proper response headers.

The CVSS score of 8.2 indicates high severity. EPSS is not publicly available, but the lack of Content‑Security‑Policy or X‑Content‑Type‑Options headers and the ability to target logged‑in admins via a simple crafted URL suggest a moderate to high likelihood of exploitation. The likely attack vector is an unauthenticated attacker delivering a malicious link that the victim clicks, causing the injected script to execute. Although not listed in the CISA KEV catalog, its high impact and ease of exploitation warrant immediate attention.