The vulnerability resides in the Klever-Go indexer, which places unescaped on‑chain account names directly into Elasticsearch bulk JSON requests. An attacker can craft a SetAccountName transaction with quotes, backslashes, or newlines that break the JSON string, reject the bulk batch, or inject additional bulk actions to create, overwrite, or delete documents in all indices writable by the indexer. Because the account name is stored in consensus state, replaying that state by any new or historic indexer will reproduce the injection, and the attacker does not need direct access to the Elasticsearch host or port. The result is forged explorer data or a corrupted index that can mislead users or render the index unusable.

The affected product is the Klever-Go Go implementation of the Klever blockchain protocol. All releases of Klever-Go older than version 1.7.20 are vulnerable. The issue exists in the indexer component that serializes account-related data for Elasticsearch updates.

The CVSS score of 8.4 marks this flaw as high severity. EPSS output is not available, but the lack of an entry in the CISA KEV catalog does not diminish the potential impact. An attacker only needs to publish a malicious account name transaction; no direct connection to the indexer or Elasticsearch is required. Once the transaction enters the blockchain, any node that runs the indexer will process the injection, potentially leading to widespread data tampering across explorer services. Attackers can repeatedly inject documents until the indices become unusable, exposing a denial‑of‑service risk.