This vulnerability involves improper neutralization of input during web page generation in the Pen Drive report generator component of Red Hat Pen Drive Powered by Red Hat Lightspeed. Specifically, cluster-sourced data such as the ClusterVersion spec.channel is embedded into HTML reports without adequate escaping or sanitization, enabling stored XSS attacks. An attacker with cluster administrator privileges can inject a malicious payload that executes in the context of users who open the affected HTML reports. The vulnerability is tracked as CVE-2026-13083 with a CVSS 3.1 base score of 6.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N).

Successful exploitation allows an attacker with cluster administrator privileges to execute arbitrary scripts in the browsers of users who view the generated HTML reports. This can lead to high confidentiality impact by exposing sensitive information, and limited integrity impact due to script execution. Availability is not affected. The vulnerability requires user interaction (viewing the report) and privileges to inject the payload.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-13083 for current remediation guidance. Until a fix is available, restrict cluster administrator privileges to trusted users only and avoid opening HTML reports generated by untrusted sources. Monitor the vendor advisory for updates on patches or official mitigations.