This vulnerability (CWE-79) in SICK AG Baggage Analytics allows improper neutralization of input during web page generation, specifically enabling JavaScript execution through the dashboard's "Open in new Tab" feature. This can lead to session hijacking by running malicious scripts in the address bar context. The vulnerability affects version 0 of the product and has a CVSS 3.1 base score of 4.5, with network attack vector, low attack complexity, high privileges required, user interaction required, unchanged scope, and high confidentiality impact but no integrity or availability impact.

Successful exploitation could allow an attacker to hijack user sessions by executing arbitrary JavaScript code in the context of the affected application. This compromises the confidentiality of user sessions but does not affect integrity or availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should exercise caution when using the "Open in new Tab" feature and consider restricting access to trusted users only until a fix is released.