The Repasat application contains a Cross‑Site Scripting vulnerability that is triggered when an attacker supplies a malicious value for the nomRuta parameter on the "/es/routes/update/693" endpoint. Exploitation of this flaw allows the attacker to inject and execute arbitrary JavaScript in the victim’s browser. This can lead to session hijacking, theft of authentication tokens, or other malicious activity that occurs within the victim’s trusted context.

The vulnerability affects the Repasat application, all versions released prior to the April 2026 patch 20260402. The patch incorporates safeguards against malicious inputs to the nomRuta parameter and was issued to close the identified XSS flaw.

The CVSS score of 4.8 places this issue in the moderate range, and no EPSS data is currently available, indicating that exploitation risk may be limited. The flaw is not listed in the CISA KEV catalog. Successful exploitation requires that a user visit a crafted URL or otherwise trigger the vulnerable endpoint, so the attack vector is largely dependent on user interaction. Although the impact is substantial in terms of client‑side code execution, the overall likelihood of widespread exploitation remains relatively low at present.