Pega Infinity versions 8.1.0 through 25.1.1 contain an HTML Injection vulnerability (CWE-80) in a user interface component. Exploitation requires a high privileged user with a developer role, which limits the attack surface. The vulnerability allows injection of script-related HTML tags due to improper neutralization, potentially leading to client-side code execution within the context of the application. The CVSS 4.0 score of 5.1 reflects a medium impact with network attack vector, low complexity, and no user interaction required. No vendor advisory or patch information is currently available.

The vulnerability could allow a high privileged developer user to inject malicious HTML or script code into the application interface, potentially leading to client-side code execution or manipulation of the user interface. Since exploitation requires high privileges, the risk is limited to trusted users with developer roles. There are no known public exploits or reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict developer role access to trusted personnel only and monitor for suspicious activity related to interface modifications. Avoid granting unnecessary high privileged roles to reduce exposure.