A stored cross‑site scripting (XSS) vulnerability exists in the Koha OPAC item detail page. An authenticated attacker who possesses edit_items permission can inject arbitrary web scripts into the item public notes field (items.itemnotes). The injected script will run each time a user views the affected item’s detail page, allowing malicious code to execute within the victim’s browser context.

Koha Library Management System versions up to and including 25.11, including any deployment that has not applied a patch correcting the OPAC item notes handling mechanism.

The CVSS score is not stated and the EPSS score is unavailable, so the precise exploit probability is unknown. The flaw is not listed in CISA’s KEV catalog. Although the attack requires an authenticated user with edit_items rights, a compromised or fraudulently obtained account would enable an attacker to persistently store malicious scripts that affect all users who access the item detail page. The lack of publicly cited exploit evidence means the actual exploitation likelihood is uncertain, but the potential to impact all users interacting with the page is significant.