CVE-2024-54997 identifies an authenticated Client-Side Injection vulnerability in MonicaHQ v4.1.1, specifically via the entry text field at the endpoint /journal/entries/ID/edit. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required but user interaction needed, and impacts limited confidentiality and integrity without availability impact. No known exploits are reported in the wild, and no patch or official fix has been documented.

An authenticated user can inject client-side code through the specified text field, potentially compromising confidentiality and integrity of data within the application context. There is no indication of availability impact. The attack requires user interaction and low complexity, but no privileges are required beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for unusual client-side behavior. Avoid entering untrusted content in the affected text field. Follow vendor updates for patch releases.