The vulnerability is reported to allow stored cross‑site scripting in the Envoy admin interface through dynamically generated stat names. The official description is unavailable, but the title and the associated CWE indicate that malicious script code can be embedded into metric names that are subsequently displayed in the admin UI. While the exact mechanism is not detailed, it is inferred that any user who triggers the generation of these stat names could inject scripts that execute within the browser context of an admin session, allowing actions such as session hijacking or defacement.

The issue affects the Envoy open‑source project. No specific product versions are listed in the CVE data; therefore, any release that exposes the admin interface and performs dynamic stat name generation is potentially vulnerable until a patch is available.

With a CVSS score of 7.4 the vulnerability is considered high. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the title and the nature of web applications, the likely attack vector is that an attacker must obtain access to the Envoy admin UI—either through legitimate administrative credentials or by tricking an administrator into visiting a crafted URL that triggers the stored script. Once the injection succeeds, the script runs with the privileges of the admin interface, potentially enabling data theft or further exploitation.