Envoy's /stats?format=html admin endpoint uses StatsHtmlRender which sanitizes statistic values but emits statistic names without HTML encoding. A data‑plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker‑controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same‑origin requests. The relevant scope boundary is that the admin interface must be browser‑accessible and an enabled component must persist attacker‑influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

The vulnerability impacts the Envoy open‑source edge and service proxy. Statistic names were unescaped in the /stats?format=html admin endpoint in all releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Therefore any Envoy deployment using an earlier version that exposes the admin UI is vulnerable until an updated release is applied.

The CVSS score of 7.4 describes a high‑severity flaw that allows stored cross‑site scripting through unescaped statistic names. Although no EPSS score is published and the vulnerability is not listed in CISA KEV, the impact remains significant. The flaw requires that the adversary be able to influence the creation of statistic names via a data‑plane component – for example, grpc_stats with stats_for_all_methods enabled – and that the affected Statistics page be rendered in a browser by an administrator. When the stats page is displayed, the malicious script runs with the same origin as the admin UI and can perform privileged same‑origin requests or steal session information.