This vulnerability (CVE-2025-23886) in Chris Roberts Annie allows stored cross-site scripting due to improper input neutralization during web page generation. It affects versions up to 2.1.1. The vulnerability could allow an attacker with at least low privileges and requiring user interaction to execute scripts in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed. No patch or official remediation information is provided in the available data.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure of information, modification of data, or disruption of service. The CVSS score of 6.5 reflects medium severity with impacts on confidentiality, integrity, and availability. However, no known exploits have been reported, and the extent of impact depends on the deployment and usage context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible within the application environment. Avoid exposing vulnerable versions to untrusted users where possible.