CVE-2026-59670 describes a Cross-Site Scripting vulnerability in the Repasat application. The vulnerability affects the 'nomListaValidacion' parameter on the endpoint '/es/validationslists/assignList/Employee/45659'. Successful exploitation could enable an attacker to execute arbitrary code in the victim's browser by tricking the user. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and low impacts on confidentiality, integrity, and availability. No patch or vendor advisory information is provided.

An attacker exploiting this vulnerability could execute arbitrary code in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side impacts. However, the CVSS vector indicates low impact on confidentiality, integrity, and availability, and user interaction is required, which limits the severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content in the affected application. No official fix or workaround information is currently provided.