The Vulnerability-Lookup application had a stored XSS vulnerability (CVE-2026-73374) in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and wrapped in markupsafe.Markup, which bypassed Jinja's automatic HTML escaping. Authenticated users with vulnerability:create or vulnerability:modify permissions could submit crafted reference tags containing arbitrary HTML or JavaScript via the CNA API. These malicious tags were stored and later rendered on public /cve/<id> or /vuln/<id> pages, causing script execution in the browser of any visitor, including unauthenticated users. The issue was resolved by applying markupsafe.escape() to each reference tag before insertion, retaining Markup only for static HTML scaffolding.

Successful exploitation allows an attacker with certain authenticated permissions to inject malicious scripts into vulnerability records that are publicly accessible. This can lead to execution of arbitrary JavaScript in the context of users visiting the affected pages, potentially enabling actions such as session hijacking, information disclosure, or content manipulation. Since the affected pages are public, even unauthenticated users can be impacted by the stored XSS payloads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was corrected by applying markupsafe.escape() to user-supplied reference tags before rendering. Until an official fix is confirmed and applied, restrict permissions to create or modify vulnerability records to trusted users only and monitor for suspicious input. Avoid visiting or sharing affected pages if exploitation is suspected.