An authenticated administrator can inject arbitrary JavaScript into the item type check‑in message field of the Koha Library Management System through version 25.11. Because the application stores the input without proper escaping, the script runs whenever other users view the message, enabling attacks such as session hijacking, defacement, or data exfiltration. This is a identified by CWE-79.

The vulnerability exists in Koha Library Management System versions up to and including 25.11. Any deployment that uses the item type administration page and grants administrators the ability to edit the check‑in message field is affected. No other vendor or product information is listed.

The CVSS or EPSS scores are not publicly disclosed, and the vulnerability is not listed in CISA KEV, indicating no known large‑scale exploitation at present. However, because the attack requires administrator privileges, the risk mainly applies to systems where such accounts are accessible over the network or from compromised local machines administrative access could use the stored script to compromise other users who view the page, but the overall exploitation probability remains moderate in the absence of broader exposure.