A stored cross‑site scripting flaw is present in the service discovery active check output component of Checkmk, allowing an attacker who can configure active or custom checks to inject arbitrary HTML or JavaScript. When an administrator or a user with host‑read permissions accesses the service discovery page, the malicious code executes within the victim’s browser, potentially exposing session cookies or allowing additional malicious actions. The vulnerability is characterized as CWE‑79.

Checkmk by Checkmk GmbH is affected. Versions lower than 2.5.0p5, 2.4.0p31, 2.3.0p48, and all releases of the 2.2.0 branch contain the issue. Updated releases beyond these thresholds incorporate the fix.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not available, so exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the capability to create or edit active/custom checks, implying privileged access is needed; however, once the malicious output is present, any user who views the service discovery page can be affected. There are no publicly reported exploits at this time.