The vulnerability is a stored cross‑site scripting flaw that arises when the static HTML report generated by CodeChecker components embeds user‑supplied fields directly into a JavaScript string via json.dumps. Because json.dumps does not escape the less‑than character, a closing </script> tag in the report message, checker name or source file path can terminate the script block and inject arbitrary HTML or script. An attacker who can influence these fields can make any user who views the exported report execute malicious code with the privileges of that user’s browser session, potentially exfiltrating data or defacing the report.

The flaw affects Ericsson’s CodeChecker product, all releases that use the plist‑to‑html conversion, the “parse –export html” command, and the “cmd diff –output html” feature. No specific version range is supplied, so any instance where the report is generated with these commands is vulnerable until a fix is applied.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the CVSS is not provided. Given the nature of XSS, the risk is medium to high if the generated report is publicly accessible or shared within an organization. Exploitation requires the attacker to inject crafted content into one of the three fields, then disseminate the resulting report to victims. The vulnerability can be triggered without elevated privileges; the attack surface is the report export interface and the hosting environment for the resulting HTML page.