This vulnerability involves a cross-site scripting (XSS) issue in the rrweb-snapshot library prior to version 2.0.0-alpha.18. An attacker can inject and execute arbitrary scripts or HTML through a crafted payload, potentially affecting users of the vulnerable versions. The vulnerability is publicly known but lacks a CVSS score and detailed vendor remediation information. No evidence of active exploitation has been documented.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts typical of XSS vulnerabilities. However, no specific impact details or exploitation reports are available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor for updates from the rrweb-snapshot maintainers and apply any official fixes once available. Until then, consider applying input validation or output encoding as temporary mitigations if feasible.