Orthanc Explorer 2 (up to version 1.12.0) contains a cross-site scripting vulnerability in the WebApplication/src/components/StudyList.vue file within the URL Handler component. The vulnerability is triggered by manipulation of the 'remote-source' argument, allowing an attacker to inject malicious scripts. This flaw can be exploited remotely without authentication. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. A patch has been created (commit 21f78ce5da668bf5233efcd1896ec7c6e3b22eae) to address this issue, and applying this patch is the recommended remediation.

Successful exploitation of this vulnerability could allow an attacker to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the affected application. This could result in session hijacking, defacement, or other malicious actions impacting users of Orthanc Explorer 2. The vulnerability is remotely exploitable and does not require privileges or user interaction beyond visiting a crafted URL.

A patch identified by commit 21f78ce5da668bf5233efcd1896ec7c6e3b22eae is available and should be applied to fix this vulnerability. Since the vendor has provided a patch, updating Orthanc Explorer 2 to a version including this fix is the recommended action. Patch status beyond the commit reference is not explicitly confirmed; users should verify the vendor's official advisory or repository for the patched release.