This vulnerability in POSIMYTH Nexter Blocks involves improper neutralization of input during web page generation, leading to a DOM-based Cross-site Scripting (XSS) issue. It affects versions up to 4.0.4 and allows an attacker with low privileges to execute scripts in the context of a victim user, requiring user interaction. The CVSS 3.1 score is 6.5, reflecting medium severity with impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to partial confidentiality, integrity, and availability impacts. This could result in unauthorized actions performed on behalf of the user or disclosure of sensitive information accessible to the browser session. However, exploitation requires user interaction and low privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content in environments using affected versions of Nexter Blocks. Monitor vendor communications for updates and apply patches promptly once released.