The vulnerability is an improper neutralization of input that permits execution of arbitrary JavaScript when a page is rendered. An attacker who can inject data into Orejime content could cause victim browsers to run malicious scripts, potentially stealing session cookies, executing actions on behalf of the user, or defacing the site. The flaw arises from lack of output encoding in the page generation code, a classic input validation weakness identified as CWE‑79.

Drupal Orejime modules prior to version 2.0.16 are affected; versions from 0.0.0 up to and including 2.0.15 contain the flaw.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation reports. Cross‑site scripting remains a high‑risk web‑application flaw. The likely attack vector involves submitting malicious input via Orejime content fields that are rendered without proper sanitization, as inferred from the description; the flaw can be triggered by any user who can write or edit Orejime content.