HCL Digital Experience Compose 9.5 contains a reflected XSS vulnerability (CWE-79) in its search center functionality. This flaw arises from improper neutralization of input during web page generation, enabling attackers to inject and execute arbitrary JavaScript in users' browsers. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity but not availability. No official fix or patch has been announced, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to information disclosure or manipulation of data accessible to the user. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been provided, users should monitor HCLSoftware advisories for updates. Until a patch is available, consider limiting exposure of the vulnerable search center component or applying web application firewall (WAF) rules to detect and block reflected XSS attempts if feasible.