A flaw in the LabelFormat field of Bacularis allows an attacker to inject a Cross‑Site Scripting payload when adding a new pool in versions 1.0.0 through 6.5.1. Because the input is not sanitized or escaped, the injected script can execute in the browser of any user who loads the page that displays the LabelFormat value.

This issue affects Bacularis when the pool‑creation feature is used in releases from 1.0.0 to 6.5.1. Any deployment running these versions and enabling pool creation is susceptible.

The CVSS score of 5.4 classifies the vulnerability as moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to interface with the Bacularis web interface and a victim who subsequently views the injected content, so the risk is confined to the user's browser session and does not provide privileges beyond what the victim has established.