This vulnerability arises from insufficiently restrictive input validation in a shared function used by the Diagram tab and Graph view of Nozomi Networks Guardian. Authenticated users with administrative privileges can inject malicious HTML tags into configuration data. When other users view this data, the injected HTML is rendered in their browsers, enabling phishing and possible open redirect attacks. However, the existing input validation and Content Security Policy limit the impact by preventing full cross-site scripting exploitation and direct information disclosure.

An attacker with administrative privileges can inject malicious HTML that is stored and rendered in the application interface for other users. This can facilitate phishing attacks and potentially open redirect attacks. The vulnerability does not allow full cross-site scripting exploitation or direct information disclosure due to mitigating controls in place. The overall impact is considered medium severity.

No official patch or remediation guidance has been provided by the vendor at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit administrative access to trusted users to reduce risk.