This vulnerability in Orthanc Explorer 2 (up to version 1.12.0) involves a cross-site scripting flaw in the URL Handler component, specifically in the StudyList.vue file. The flaw is triggered by manipulation of the 'remote-source' argument, which is not properly sanitized, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and limited impact on integrity and availability. A patch commit (21f78ce5da668bf5233efcd1896ec7c6e3b22eae) has been identified as the fix.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected Orthanc Explorer 2 application, potentially leading to session hijacking, information disclosure, or other client-side impacts. The impact is limited to the client side and does not affect system integrity or availability directly. No known active exploitation has been reported.

A patch identified by commit 21f78ce5da668bf5233efcd1896ec7c6e3b22eae is available and applying it is the recommended action to remediate this vulnerability. Since the vendor advisory or official remediation level is not explicitly provided, users should verify and apply the patch from the official Orthanc project repository or releases. No alternative mitigations are specified.