This vulnerability involves improper neutralization of special elements in Angular templates within the Reports feature of Nozomi Networks Guardian. An authenticated user with report privileges can inject Angular template code into reports, which executes in the browser of users who view or import these reports. The vulnerability allows limited impact such as modification of application data or disruption of application availability. Existing input validation and Content Security Policy prevent full XSS exploitation and direct information disclosure. No patch or official remediation level has been published, and the product is not a cloud service.

An attacker with report privileges can craft malicious report templates that execute Angular code in the browser context of users who view or import them. This may lead to unauthorized modification of application data or disruption of application availability. The vulnerability does not allow full cross-site scripting or direct information disclosure due to existing mitigations. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit report privileges to trusted users only and exercise caution when importing report templates from untrusted sources. The existing input validation and Content Security Policy provide partial mitigation against full exploitation.