The vulnerability is a reflected Cross‑Site Scripting flaw that occurs when the render_jinja.__init__() function of Web.py version 0.76 processes untrusted input without proper encoding. An attacker can embed arbitrary JavaScript that will run in the browsers of users who view a page rendered by that function. Depending on site design, this can lead to session hijacking, theft of credentials, defacement, or the delivery of phishing content, but it does not provide direct remote code execution on the server.

The flaw is present in the Web.py 0.76 web framework when the render_jinja component is used. Any web application that incorporates Web.py 0.76 and relies on render_jinja.__init__() for template rendering is affected. No other product versions are listed as vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so exploitation probability cannot be quantified. However, XSS vulnerabilities generally require user interaction or an infected link and are considered moderate to high risk for sites that expose untrusted data to users. The CVSS score is not supplied, but the impact of injecting arbitrary script can be substantial if user accounts are compromised. Attackers could exploit the flaw by delivering malicious URLs or posting crafted content that includes the vulnerable render call.