The vulnerability allows a user with permission to edit a Part name to embed arbitrary HTML in the name. When another user imports a bill of materials referencing that Part, the stored name is rendered unescaped in the BOM validation results page, leading to cross-user stored HTML injection. While the current content security policy blocks JavaScript execution, the attacker can still inject links, forms, images, and CSS elements into the Part-DB interface.

The issue affects the open-source Part-DB inventory management system, specifically Part-DB-server, in all versions prior to 2.12.2. The vulnerability is fixed in release 2.12.2.

The CVSS score is 5.7, indicating a moderate severity. Exploitation requires a user with edit rights to a Part and a second user to import a BOM that references the malicious Part. The EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely internal or privileged user access; the potential impact includes visual spoofing, phishing, or misleading UI elements but no direct code execution due to the content security policy.