A flaw was identified in the Window Message Event handler of wandb OpenUI version 1.0 and earlier, located in frontend/public/annotator/index.html. The vulnerability allows an attacker to deliver crafted input that is processed by the handler, resulting in the injection of unintended scripts into the web page. Because the injected code runs in the context of the page, the flaw can let attackers execute arbitrary JavaScript in a user’s browser, potentially exposing data or altering page behavior.

The affected product is wandb OpenUI, any installation running version 1.0 or earlier. Users who have not upgraded beyond this release are susceptible until an official fix is released.

The CVSS score of 5.1 suggests a moderate severity level. The exploit is capable of being triggered remotely, as an attacker only needs to supply a malicious message event to the vulnerable handler. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the public disclosure indicates that attackers are likely to craft and distribute malicious payloads that target the vulnerability.