This vulnerability (CVE-2026-39491) in artbees JupiterX Core is classified as CWE-79, indicating improper neutralization of input leading to cross-site scripting (XSS). It affects versions up to and including 4.14.1. The flaw allows a subscriber-level user to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity but requires some user interaction and privileges at the subscriber level. No official fix or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of the affected web application. This may lead to partial compromise of user data confidentiality, integrity, and availability. The vulnerability does not require high privileges but does require user interaction and subscriber-level access. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting subscriber privileges and monitoring for suspicious activity related to script injection. Avoid granting unnecessary permissions to subscriber roles and apply any available security controls to reduce the risk of exploitation.