The vulnerability is present in the getServerSideProps function of the Sign‑in Auto‑Redirect page of pingvin‑share. By supplying a specially crafted redirect value, an attacker can inject arbitrary JavaScript that is rendered in the victim’s browser. This remote cross‑site scripting can lead to session hijacking, credential theft, or other client‑side malicious actions.

The flaw affects the open‑source dashboard application pingvin‑share developed by stonith404, for all releases up to and including version 1.13.0. No later releases are known to contain the vulnerable redirect handling logic.

With a CVSS score of 5.3 the vulnerability is considered moderate. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, yet a public exploit has been released and can be triggered remotely by sending a crafted request to the sign‑in endpoint with a malicious redirect parameter. The lack of input validation or output encoding creates a straightforward XSS vector for anyone who visits the affected sign‑in page.