This vulnerability in wandb OpenUI up to version 1.0 involves a cross-site scripting flaw in the Window Message Event Handler within the frontend/public/annotator/index.html file. An attacker can remotely manipulate this component to inject and execute malicious scripts. The CVSS 4.0 base score is 5.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and partial user interaction needed. The vendor has not provided a patch or advisory, and the vulnerability was publicly disclosed without vendor response.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other script-based attacks. However, the impact is limited by the need for some user interaction and the partial integrity impact as per the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing web application firewalls or input validation controls as temporary mitigations. Monitor official vendor channels for updates or patches addressing this vulnerability.