The vulnerability identified as CVE-2025-31418 affects noonnoo Gravel versions up to 1.6 and is categorized as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as reflected Cross-site Scripting (XSS). This issue allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to unauthorized actions or data exposure. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low level each. No patch or official remediation level has been published by the vendor, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity impact, but no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts if feasible.