This vulnerability involves improper neutralization of special elements used in a template engine (CWE-1336) within the Reports feature of Nozomi Networks Guardian. An authenticated user with report privileges can inject malicious Angular templates into reports. When these reports are viewed or imported by other users, the Angular template executes in the victim's browser context. Although full XSS and direct data disclosure are mitigated by existing input validation and Content Security Policy, the attacker can still modify application data or disrupt application availability. No official fix or patch has been disclosed as of the publication date.

An attacker with authenticated report privileges can inject Angular template payloads that execute in the browser context of users who view or import the malicious reports. This can lead to modification of application data or disruption of application availability. However, the vulnerability does not allow full cross-site scripting exploitation or direct information disclosure due to existing input validation and Content Security Policy measures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit report privileges to trusted users and exercise caution when importing or viewing reports from untrusted sources.