This vulnerability allows an attacker to inject arbitrary JavaScript into the wetty client by inserting a specially crafted base64‑encoded filename in a file‑download escape sequence. When the client decodes and directly injects the filename into an unescaped Toastify HTML string, the script runs in the wetty origin and automatically types attacker‑chosen keystrokes in the victim’s SSH session, giving the attacker full control over that session. The flaw is a classic DOM XSS (CWE‑79) that can lead to remote code execution on the user’s machine.

Affected systems are installations of butlerx:wetty released before version 3.0.4. Any deployment using those earlier releases is vulnerable. Operators should check the current version and confirm that it is at least 3.0.4.

The CVSS score of 8.6 indicates high severity, and the lack of an EPSS score precludes a precise exploitation probability estimate, but the vulnerability being a DOM XSS that executes payload in the user’s browser makes it readily actionable by anyone who can deliver a malicious payload to the victim. The issue is not listed in the CISA KEV catalog, meaning no known widespread exploitation has been reported yet, but the risk of exploitation remains high if attackers gain a foothold or can trick users into downloading crafted files. Prompt remediation is therefore advised.