The vulnerability resides in HotGo 1.0/2.0 within MessageList.vue of the editNotice endpoint. By manipulating input to that component, an attacker can inject arbitrary JavaScript that executes in the context of victim browsers. This cross‑site scripting can lead to credential theft, session hijacking, or defacement. The flaw is a classic unsanitized input error, classified as CWE‑79.

HotGo, open‑source project from bufanyun, was affected in its 1.0 and 2.0 releases. Any deployment that uses the editNotice feature and serves the MessageList.vue component remains vulnerable. Users should confirm their HotGo installation version and whether the component is active.

The CVSS base score of 5.1 indicates medium severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, but a publicly available exploit demonstrates that attackers can launch the attack remotely. Because the flaw arises from client‑side template rendering, it can be exploited by simply visiting a crafted URL, putting the risk within the attack surface for any authenticated or unauthenticated user who can reach the editNotice endpoint.