An attacker can inject malicious scripts into the redirectTo parameter of the reset password handler in the Rallly application, allowing remote XSS. The flaw originates from unvalidated input that is reflected in client‑side code, representing a typical CWE‑79 reflected XSS weakness, and also correlates with CWE‑94 dynamic code injection due to the misuse of the redirect parameter. An attacker who successfully delivers a crafted reset link could execute arbitrary JavaScript in the victim’s browser; based on the description, it is inferred that this might lead to disclosing session cookies, login credentials or performing actions on behalf of the user. This type of vulnerability is moderate in severity per the CVSS score of 5.1 and could be exploited by any remote actor who can entice users to click a malicious URL.

The vulnerability affects the Rallly application by lukevella, specifically versions up to and including 4.7.4. The repository and progress timeline are available on GitHub, and a fix was released in version 4.8.0. Users running any earlier version should consult the changelog and upgrade to at least 4.8.0 to eliminate the flaw.

The CVSS score of 5.1 indicates moderate impact; the EPSS score of <1% (approximately 0.00034) indicates a low but non-zero likelihood of exploitation, but the presence of publicly available exploit code and the ability to mount the attack remotely heightens the risk. The flaw is not yet listed in the CISA KEV catalog, yet the presence of an exploit suggests a realistic threat. An attacker can initiate the attack by sending a link that contains a malicious redirectTo value to a target user, who then executes the payload when the reset password page renders. No special privileges or local access are required, making this a straightforward vector for social engineering or phishing campaigns.