CVE-2024-22048 is a cross-site scripting vulnerability in govuk_tech_docs affecting versions from 2.0.2 to before 3.3.1. The vulnerability arises from improper neutralization of input during web page generation, specifically in the search results page. An attacker can inject malicious JavaScript that executes in the context of the user's browser when viewing a manipulated search result. This can lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS vector indicates the attack can be performed remotely with low attack complexity, no privileges required, but requires user interaction, and results in a scope change.

Successful exploitation allows execution of arbitrary JavaScript in the victim's browser via malicious search results, potentially leading to information disclosure and modification of web page content within the affected application context. There is no impact on system availability. The vulnerability affects confidentiality and integrity to a limited extent.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with search results and consider implementing input sanitization or output encoding workarounds if possible.