CVE-2026-12129 is a cross-site scripting vulnerability affecting CodeAstro Human Resource Management System 1.0. The vulnerability exists in the Dashboard Interface component, specifically in the /dashboard/add_tod file. An attacker can manipulate the todo_data argument to inject malicious scripts, which may be executed in the context of a victim's browser. The vulnerability can be exploited remotely without requiring elevated privileges, but user interaction is needed. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and low impact on confidentiality and integrity.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions performed on behalf of the victim user. The impact is limited by the need for user interaction and the low integrity and confidentiality impact ratings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization on the todo_data parameter if possible, or restrict access to the vulnerable endpoint. Monitor vendor communications for updates on patches or official mitigations.