This vulnerability involves improper neutralization of special elements used in a template engine (CWE-1336) within the Dashboards feature of Nozomi Networks Guardian. An authenticated user with required privileges can embed malicious payloads in dashboards, or victims can be socially engineered to import malicious dashboards. Execution of the payload occurs in the victim's browser context upon viewing or importing the dashboard, which may allow attackers to alter application data or disrupt service availability. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, no attack or user interaction required beyond privilege and UI interaction, and limited impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with authenticated privileges to execute arbitrary code in the victim's browser context via crafted dashboards. This can lead to modification of application data or disruption of application availability. The attack requires user interaction to view or import the malicious dashboard. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict dashboard creation and import privileges to trusted users only and educate users to avoid importing dashboards from untrusted sources.