The flaw lies in the JSON Pointer-to-accessor compiler within Cribl Stream, where unsanitized input can be used to generate executable JavaScript. An attacker with authenticated edit privileges who supplies a crafted database connection identifier or pack configuration value can cause the server to run arbitrary JavaScript, compromising integrity, confidentiality, and potentially full system control.

Cribl Stream versions prior to 4.18.2 are vulnerable. The issue applies to deployments that use the JSON Pointer processing component for database connections or pack configurations.

The CVSS score of 8.7 reflects high severity. Exploitation requires authenticated access with edit rights, limiting the attack surface to powerful accounts but still posing significant risk. The EPSS score indicates a very low exploitation probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. No public exploit is documented, but the lack of a workaround means the recommended action is to apply the upgrade immediately.