This vulnerability (CVE-2026-39491) in artbees JupiterX Core (<=4.14.1) is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, or Cross-site Scripting). It allows subscriber-level users to inject malicious scripts due to insufficient input sanitization. The CVSS 3.1 base score is 6.5, with attack vector network, low attack complexity, requiring privileges at the subscriber level, user interaction required, and scope changed. The impact affects confidentiality, integrity, and availability at a low level. No patch or official remediation level has been published as of the data provided.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of the affected web application, potentially leading to partial compromise of user data confidentiality, integrity, and availability. The impact is rated medium severity with limited scope due to required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit subscriber privileges where possible and monitor for suspicious activity related to script injection. Avoid granting unnecessary user rights that could be leveraged to exploit this vulnerability.