A stored cross‑site scripting flaw exists in OCO‑Server’s command button helper. The server embeds an unvalidated computer hostname into a JavaScript string inside an inline onclick handler. Only HTML entity escaping is performed; browsers unescape the string before executing the script, allowing a crafted hostname to break out of the string and inject arbitrary JavaScript. The injected script runs with the privileges of an authenticated administrator, enabling the attacker to perform administrative operations such as deploying software jobs or accessing sensitive data.

Instances of OCO‑Server produced by schorschii running any version prior to the public 1.2.1 release are affected. The vulnerability was fixed in v1.2.1; all earlier releases remain vulnerable.

The CVSS score of 7.4 signifies a moderate to high severity, and the EPSS score is not available. Exploitation requires an attacker to possess the shared agent‑registration‑key to register a malicious hostname when the agent‑self‑registration feature is enabled. The attacker then needs an administrator to click the vulnerable command button, which means the attack is user‑interactive. Because the script executes in the context of a privileged session, the impact is severe, but the overall risk is moderated by the requirement for administrators to trigger the button. The vulnerability is not listed in CISA KEV.