This vulnerability allows an attacker to inject code via an unescaped date field value in Doggo’s form rendering logic. The component normalizes date fields as safe strings and places them verbatim into the value attribute of an <input type="date"> element. The string is truncated to ten bytes, sufficient to terminate the attribute and inject a short payload such as an event handler or the start of a new element but not enough to include a full script body. The result is a reflected XSS that can execute alternate JavaScript in the vulnerable context and potentially carry out phishing or cookie theft.

The issue exists in all releases of woylie Doggo from 0.1.0 up to but not including 0.14.8. Applications that render <.field type="date"> with user‑supplied values are impacted.

The CVSS score of 5.3 reflects moderate severity, stemming from the fact that the attacker must submit a request containing the reflected payload and that the window for arbitrary code execution is limited. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. However, if an application publicly exposes its forms and does not perform additional validation, a local or remote attacker could send a crafted request that triggers the reflected XSS.