A malicious obfuscated JavaScript payload is embedded in the Blade template that renders security OTP emails. When a user’s browser processes the affected email with JavaScript enabled, the payload runs, establishing a WebSocket connection to a hardcoded command‑and‑control endpoint, installing a password‑field keylogger through a MutationObserver, scraping WhatsApp Web DOM content, and accepting remote commands to redirect or overwrite the rendered page. The result is unauthorized code execution in the browser environment, consistent with CWE‑506.

VaahCMS versions 2.0.0 through 2.3.4 from the vendor webreinvent:vaahcms are affected. No narrower sub‑versions are specified. Users running any of these releases should assume the vulnerability is present.

The CVSS score of 9.2 indicates a high‑severity risk. The EPSS score of less than 1% suggests a low overall exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so no known high‑profile exploitation data is available. The likely attack vector is an attacker delivering or manipulating an email that triggers the rendering of the compromised template in a victim’s browser. Exploitation requires the victim’s email system or client to execute HTML/JavaScript from the email, a common scenario for phishing or credential‑stealing attacks.