Pandora’s URL observables are rendered inside a JavaScript onclick handler. Although the template engine HTML‑escapes the value, the escaped content is placed inside a JS string that is itself embedded in an HTML attribute. A specially crafted attack‑controlled URL can break out of that JS string and inject arbitrary JavaScript. When the victim clicks the affected Submit to Lookyloo control, the injected script runs with the privileges of the authenticated Pandora session, allowing the attacker to read browser‑side data or perform authenticated actions on behalf of the user.

The vulnerability exists in Pandora, the open‑source threat intelligence platform. All Pandora releases that include the legacy Submit to Lookyloo inline JavaScript handler are affected; the exact affected sequence numbers are not publicly listed, but the patch is referenced in the commit that removed the inline JS logic.

The CVSS score of 7 indicates a medium‑to‑high severity stored XSS that can lead to extensive damage. EPSS data is not available, so the current exploitation probability is unknown, though the lack of a KEV listing suggests there are no publicly known exploits at the time of analysis. The exploit path requires an attacker to supply a malicious URL and then persuade a user to click the Submit to Lookyloo button, so social engineering or compromised data sources are typical attack vectors. Once executed, the attacker can manipulate the victim’s session and read or modify data within Pandora.