Forem versions before commit 92eacd16a allow a malicious string submitted through feedback_message[message] to be stored without sanitization and later rendered unescaped with raw(feedback_message.message). When an administrator opens the abuse report, the browser executes the injected JavaScript. This can expose sensitive page data, steal CSRF tokens, or trigger administrative actions within the victim’s session.

All Forem community software releases prior to commit 92eacd16a are affected, including the mainstream Forem platform. The vulnerability is reachable because the public FeedbackMessagesController accepts abuse reports from unauthenticated users and permits an offender_id, which enables a crafted report to be stored and later rendered in the admin interface.

The CVSS score of 6.3 indicates moderate severity. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, implying no known widespread exploitation. However, the attack requires only that an attacker can submit a feedback report—an unauthenticated action—and that an administrator subsequently views the report. In that scenario the stored script runs in the admin’s browser, which can compromise confidentiality, integrity, and availability of administrative capabilities. The potential impact is considerable for compromised administrators, making the risk high in environments where admins frequently access abuse reports.