The vulnerability allows a user with SELECT privilege to embed JavaScript into a table alias in an Impala query plan. When another user opens that query plan through the Impala Web UI, the injected script executes in their browser. This is a stored cross‑site scripting attack (CWE‑79) that can lead to session hijacking, credential theft, or arbitrary content injection.

Apache Impala versions 4.5.2 and earlier are affected. The issue exists in all deployments that provide SELECT permission to users and expose the query plan interface in the web UI.

The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale exploitation yet. However, the attacker only needs SELECT access, which is commonly granted. If the attacker can create the malicious query plan, any user who visits the web UI and opens that plan will have their browser compromised. This represents a potential impact on confidentiality, integrity, and availability of the impacted user’s session. With a CVSS score of 5.4, the flaw is considered moderate severity, but the low EPSS score suggests a lower likelihood of exploitation, so organizations should prioritize remediation accordingly.