A host header injection vulnerability allows an unauthenticated remote attacker to manipulate the base URL that Pico generates when the base_url setting is unset. By injecting Host, X-Forwarded-Host, X-Forwarded-Proto, or X-Forwarded-Port headers, the attacker causes the application to build an external base URL which is then propagated to theme_url, assets_url, and plugins_url. The result is that the site’s theme loads JavaScript and stylesheet tags from a domain under the attacker’s control, enabling the injection of arbitrary script payloads or malicious stylesheets. The impact includes potential cross‑site scripting, phishing, or remote code execution within the visitor’s browser.

picocms Pico, versions up to and including 2.1.4, where the base_url configuration is not set. The vulnerability is present in all installations that use the default configuration and rely on host header information to build URLs.

The CVSS score of 6.1 indicates a moderate impact with potential high consequences if combined with other flaws. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. The attack vector is remote over HTTP, requiring the attacker to control the Host header of a request to the target server. An unauthenticated attacker can exploit this by sending a crafted request to any public URL that the Pico site serves, causing browsers visiting the site to load resources from the attacker‑controlled domain.