The vulnerability in Octopus Server allows an attacker with certain access levels to embed malicious scripts via artifacts. These scripts can execute in the victim’s browser, potentially stealing cookies, hijacking sessions or defacing content. The impact is primarily a client‑side compromise that could lead to confidentiality and integrity violations for users interacting with the server.

The affected product is Octopus Deploy Octopus Server. No specific affected versions were listed; the issue applies to versions of Octopus Server that have not been patched to address the XSS bug.

The CVSS score of 5.6 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation data. The attack vector is likely via the web interface where users can upload or view artifacts, and it requires that the attacker has sufficient permissions to add or modify artifacts.