A flaw in Casdoor 2.356.0 allows malicious content to be passed into the dangerouslySetInnerHTML function through user‑supplied fields such as formCss, formCssMobile, or formSideHtml. When the application renders these fields without proper filtering, injected scripts are executed in the victim’s browser. The result is classic client‑side code execution, enabling session hijacking, defacement, or further lateral exploitation.

Only users running Casdoor 2.356.0 are affected. Earlier or later releases that have been updated to remove the vulnerable function are not impacted. No other vendors or products are listed as affected.

The CVSS score of 5.1 places this issue in the medium severity range, while an EPSS score of less than 1% suggests that exploitation activity is currently low. Because the flaw can be triggered remotely, any authenticated or potentially unauthenticated user interacting with the affected interfaces may exploit it. The vulnerability is not yet in the CISA KEV catalog, but the public release of an exploit script means attackers could weaponize it before a patch is applied.