A stored cross‑site scripting vulnerability exists in Vulnerability‑Lookup’s render_tag_badges Jinja filter, where reference tag values from the CNA API are interpolated directly into HTML badges without sanitization and then wrapped in markupsafe.Markup, bypassing Jinja’s escape mechanism. An authenticated attacker with the vulnerability:create or vulnerability:modify permission can store malicious HTML or JavaScript in a reference tag; when any user explores the public /cve/<id> or /vuln/<id> page, the embedded script executes in the victim browser with the privileges of the Vulnerability‑Lookup application, allowing session hijacking, data theft, or arbitrary content injection. This flaw is identified as CWE‑79.

The affected product is Vulnerability‑Lookup; no explicit version range is listed in the CNA record, but the security fix adding markupsafe.escape to reference tag processing is present in the commit dated d29901655c50cf3c25737d9ea86180268df51b57. Administrators should verify that their deployed release includes this change and that no legacy reference tags remain unsanitized.

With a CVSS score of 6.1, the vulnerability is moderately severe; the EPSS score is not available, and it is not recorded in the CISA KEV catalog. Exploitation requires legitimate permission to create or modify vulnerability records, but once a malicious tag is stored the effect spreads to all users who view the affected CVE or vulnerability page, including unauthenticated visitors, making the risk moderate to high depending on exposure. Attackers could steal session cookies, inject malicious scripts, or alter page content in the victim’s browser session.