This vulnerability involves improper neutralization of special elements used in the Angular template engine within the Reports feature of Nozomi Networks Guardian. An authenticated user with report privileges can create a malicious report embedding an Angular template payload. Alternatively, a victim may be socially engineered to import a malicious report template. Upon viewing or importing the report, the Angular template executes in the victim's browser context, enabling the attacker to alter application data or disrupt application availability. However, the existing input validation and Content Security Policy limit the attacker's ability to perform full cross-site scripting or directly disclose information. No official fix or patch has been disclosed as of the published date.

An attacker with report privileges can inject Angular template payloads that execute in the browser context of users viewing or importing malicious reports. This can lead to modification of application data or disruption of application availability. Full cross-site scripting exploitation and direct information disclosure are mitigated by existing input validation and Content Security Policy. There is no evidence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit report privileges to trusted users and educate users to avoid importing untrusted report templates. Monitor vendor communications for updates on patches or mitigations.