This vulnerability is a cross-site scripting (CWE-79) issue in Proxmox Virtual Environment (PVE) versions 9.x 5.1.8 and 8.x 4.3.16. It enables remote attackers to execute arbitrary web scripts or HTML by injecting crafted payloads. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges and requires user interaction, with a scope change and impacts on confidentiality and integrity but not availability. The vulnerability is published and assigned CVE-2026-51081, but no remediation level or patch information is currently provided.

Successful exploitation of this XSS vulnerability could allow attackers to execute arbitrary scripts in the context of the affected web interface, potentially leading to information disclosure or manipulation of web content. The CVSS score of 6.1 reflects a medium impact on confidentiality and integrity, with no impact on availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying web application firewall (WAF) rules to detect and block malicious payloads targeting the web interface. Monitor vendor communications for updates on patches or official mitigations.