This vulnerability (CVE-2025-24544) affects dashed-slug.net Bitcoin and Altcoin Wallets versions up to 6.3.1 and is caused by improper neutralization of input during web page generation, resulting in reflected cross-site scripting (XSS). The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level. The vulnerability allows an attacker to inject malicious scripts that execute in the context of a victim's browser when they visit a crafted URL or page.

Successful exploitation of this reflected XSS vulnerability can lead to the execution of arbitrary scripts in the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability at a limited level. The CVSS vector indicates that the attack can be performed remotely without privileges but requires user interaction. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users and administrators should monitor the vendor's communications for updates. Until a fix is available, caution should be exercised when interacting with untrusted links or inputs related to the affected wallets.