The flaw is an improper neutralization of input when generating web pages, allowing a cross‑site scripting (XSS) attack. An authenticated attacker can inject malicious input that is rendered in the Canvas web interface, giving the attacker higher privileges over the network. The vulnerability enables the execution of arbitrary scripts in the context of a legitimate user, potentially escalating privileges within the collaborative environment.

Microsoft Windows Live Share Canvas SDK is affected. No specific version information is provided, so any installation of the SDK that has not been updated by Microsoft is potentially vulnerable.

The CVSS score of 8 reflects high severity. EPSS is not available, and the vulnerability is not included in CISA's KEV catalog. Exploitation requires the attacker to be an authorized user within the same network or collaboration session, making the attack vector an authenticated web‑based XSS that can elevate privileges. The lack of listed exploits suggests that the vulnerability has not yet been widely abused, but the high CVSS indicates significant risk if exploited.