CVE-2025-52277 describes a Cross Site Scripting (CWE-79) vulnerability in YesWiki version 4.54. The issue arises from improper sanitization of input in the meta configuration robots field, enabling remote attackers to inject and execute arbitrary code via crafted payloads. The vulnerability is exploitable over the network without privileges and requires user interaction. It impacts confidentiality and integrity but not availability, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No patch or fix information is currently provided.

Successful exploitation could allow remote attackers to execute arbitrary code in the context of the victim's browser, potentially leading to partial compromise of confidentiality and integrity of user data. The attack requires user interaction and can be performed remotely without authentication. There is no indication of impact on system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted content in the meta configuration robots field. Consider applying input filtering or disabling the affected feature if possible.