CVE-2026-12129 is a cross-site scripting vulnerability affecting CodeAstro Human Resource Management System 1.0. The vulnerability exists in the Dashboard Interface component, specifically in the /dashboard/add_tod file, where the todo_data argument is not properly sanitized. This allows remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability requires low attack complexity and no privileges but does require user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, partial user interaction, and low impact on confidentiality and integrity.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. The impact is rated medium due to limited integrity and confidentiality impact and the requirement for user interaction.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider applying input validation and sanitization on the todo_data parameter as a temporary mitigation and exercise caution when interacting with untrusted input.