This vulnerability in RomanCode MapSVG (up to version 8.7.22) involves improper neutralization of input during web page generation, resulting in a DOM-based Cross-site Scripting (XSS) flaw. An attacker could exploit this by injecting malicious scripts that execute in the victim's browser, potentially leading to limited confidentiality, integrity, and availability impacts as reflected in the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vulnerability is publicly disclosed but lacks an official patch or remediation guidance at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial compromise of user data confidentiality, integrity, and availability. The CVSS score of 6.5 indicates a medium impact level. No known exploits in the wild have been reported, and the vulnerability requires some user interaction and privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any available workarounds or input validation controls at the application level to mitigate DOM-based XSS risks. Monitor RomanCode's official channels for updates regarding patches or official mitigations.