The vulnerability occurs when a search term is passed through the clean‑URL route /search/<term> in Serendipity versions 2.3.5 through 2.6.0. The backend decodes the URL‑encoded term after performing HTML encoding, allowing a specially crafted payload to survive HTML escaping and be rendered as live HTML. An attacker who can insert a malicious search term into a link that a victim clicks can therefore execute arbitrary JavaScript in the victim’s browser. This permits client‑side data theft, hijacking of the victim’s session, cookie theft, defacement and the delivery of phishing content to users. The flaw is a classic reflected cross‑site scripting (CWE‑79).

Affected versions of Serendipity include 2.3.5, the 2.4.0 line (both the release and beta1 builds), 2.5.0, and 2.6.0 (including beta1). All of these versions implement the vulnerable clean‑URL search route. Versions 2.6.1 and later contain the fix and are not affected.

The CVSS base score for the vulnerability is 5.3, indicating moderate severity. The EPSS score is not available, but the lack of a reported exploit in CISA’s KEV catalog suggests there are presently no active, widespread attacks. The typical exploitation path would involve an attacker crafting a malicious search URL and tricking a victim into visiting it, which requires user interaction. Despite the moderate CVSS score, any publicly‑facing Serendipity instance that allows unauthenticated searches remains susceptible to the client‑side code execution that follows. Administrators should treat this as a risk worth mitigating promptly, especially if the site serves any sensitive or high‑profile visitors.