A cross‑site scripting vulnerability exists in the SHIRASAGI project that allows an attacker to embed and execute arbitrary script on a user’s web browser when the user accesses a website powered by the affected product. This weakness permits the injection of malicious JavaScript, potentially leading to hijacked sessions, data theft, or the propagation of malware. The attack is limited to the browser context, so the impact on server confidentiality, integrity, or availability is indirect, but the user’s credentials and personal data can be compromised if the script exfiltrates information or manipulates the page.

The affected system is the SHIRASAGI project. No specific version information or product sub‑components are provided in the current data; therefore any deployment of SHIRASAGI is considered potentially vulnerable until a vendor patch is applied.

The CVSS score of 5.1 indicates a moderate risk level. The EPSS score is not available, adding uncertainty to the likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a malicious URL or user input that triggers the vulnerable page, requiring victim interaction. Because it is a client‑side flaw contingent on browser execution, the risk is confined to users who visit or interact with the affected site, but the potential for widespread damage exists if the malicious script is widely disseminated.