This vulnerability in wandb OpenUI 1.0 involves improper handling of the ID argument in the create_share/get_share functions of the HTMLAnnotator component, allowing an attacker to perform HTML injection via cross-site scripting. The issue is remotely exploitable without authentication and requires user interaction. The vendor has not provided a fix or advisory, and no official patch links are available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity.

Successful exploitation allows an attacker to inject malicious HTML content into the application, potentially leading to cross-site scripting attacks. This can result in the execution of arbitrary scripts in the context of the affected application, which may impact users interacting with the vulnerable component. The impact is rated medium based on the CVSS score and the nature of the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing input validation or sanitization on the ID parameter as a temporary mitigation. Monitor official vendor channels for updates or patches.