The vulnerability is a stored cross‑site scripting flaw in madpsy’s ka9q_ubersdr chat rendering code. URLs entered in chat messages are not properly neutralised before being turned into HTML links. An attacker can embed a URL that contains quotation characters to escape the generated href attribute and inject arbitrary JavaScript or other HTML attributes. When a stored chat message is later displayed to another user in the browser, the injected code is executed automatically; no user interaction with the link is needed.

This flaw affects the ka9q_ubersdr application supplied by the vendor madpsy, for all releases earlier than version 0.1.58. Users who run any pre‑0.1.58 build and enable the chat component are exposed to the risk, regardless of whether chat is used by an internal or external user base.

The CVSS score of 5.4 indicates a moderate level of severity. Because the flaw is stored XSS, any user who can post a chat message can potentially compromise the browsers of all other users that view that message. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires only the ability to create a chat entry; no additional privileges or external trigger such as a click are necessary. Once the vulnerable message is rendered, the injected script runs in the victim’s browser context, allowing attacker‑controlled code execution.