A stored XSS flaw exists in RabbitMQ’s web‑based management interface. The server renders unescaped values supplied in the x‑internal‑purpose attribute of queues or exchanges as the HTML title attribute on the Queues and Exchanges pages. A user who can declare a queue or exchange with a crafted argument can inject JavaScript that will execute in the browser of any other userside injection (CWE‑79) that can compromise user sessions, exfiltrate credentials, or otherwise subvert the UI for an attacker. The vulnerability does not grant direct server‑side code execution, but it enables arbitrary script execution in a victim’s context.

RabbitMQ server versions earlier than 4.2.5 are susceptible. The issue is fixed in 4.2.5 and later releases of the rabbitmq-server product.

The CVSS score of 7.1 indicates a moderate severity, and the EPSS score is less than 1%, suggesting a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker needs authorization to declare a queue or exchange, so the attack vector is likely internal or lateral within an existing RabbitMQ deployment rather than external. Once the queue or exchange is created, any user with access to the management UI can be targeted by the injected script. The impact is limited to actions in a web browser, but the consequences could include session hijacking or data theft for privileged users of the management console.