CVE-2026-17528 describes a Cross-site Scripting (XSS) vulnerability in the nice-select2 package affecting versions prior to 2.4.1. The issue occurs because user-supplied input via the <select> element is not properly sanitized before being rendered into the DOM, allowing an attacker to inject malicious scripts. This can result in arbitrary script execution in the context of the victim's browser session. The vulnerability has no known exploits in the wild and no official remediation or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and has a low complexity (AC:L) with no privileges required (PR:N). The impact on confidentiality, integrity, and availability is low to limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions of nice-select2 or implement input sanitization and output encoding on the <select> element to mitigate XSS risks.