This vulnerability involves improper neutralization of input during web page generation in the Pen Drive report generator of Red Hat Pen Drive Powered by Red Hat Lightspeed. Specifically, cluster-sourced data such as the ClusterVersion spec.channel is embedded into HTML reports without adequate escaping or sanitization. A cluster administrator can exploit this by injecting a stored XSS payload into cluster objects, which then executes in the browsers of users who open the affected HTML reports. The vulnerability requires high privileges (cluster administrator) and user interaction (opening the report) and impacts confidentiality with limited integrity impact and no availability impact.

An attacker with cluster administrator privileges can inject malicious scripts into cluster objects that are included in HTML reports. When other users open these reports, the injected scripts execute in their browsers, potentially leading to unauthorized disclosure of information (confidentiality impact). The integrity impact is limited, and there is no impact on availability. This could allow attackers to perform actions in the context of the victim's browser session when viewing the report.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-13083 for current remediation guidance. Until a fix is available, restrict cluster administrator privileges to trusted users only and avoid opening HTML reports generated by untrusted sources. Monitor the vendor advisory for updates on patches or official mitigations.