This vulnerability is an improper neutralization of input during web page generation in CoolerControl’s coolercontrol-ui log viewer. Unauthenticated users can inject malicious JavaScript into log entries, which the interface renders without sufficient sanitization. The injected code runs within the context of service users, enabling session hijack, data exfiltration, or even full service takeover, thereby compromising confidentiality, integrity, and availability.

The CoolerControl coolercontrol-ui component is affected in all releases older than version 4.0.0. Administrators should verify that their installation’s version is below 4.0.0 and plan an upgrade accordingly.

With a CVSS score of 7.6, this issue is high severity. Attackers require no authentication and can simply navigate to the log viewer to deliver the payload, as the description explicitly states. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the ease of exploitation and the serious impact keep the risk significant for exposed deployments.