This vulnerability in bufanyun HotGo 1.0 and 2.0 involves a cross-site scripting flaw in the editNotice endpoint implemented in the MessageList.vue component. An attacker can remotely manipulate input to inject malicious scripts, potentially leading to execution of arbitrary scripts in the victim's browser. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. The vendor was notified but has not issued a fix or advisory. No patch or mitigation guidance is currently available from the vendor.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. Since the vulnerability is remotely exploitable and the exploit is publicly available, there is an increased risk of attack. However, the impact is limited to the scope of the XSS vulnerability and does not indicate privilege escalation or server compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider applying web application firewalls (WAF) or input validation controls as temporary mitigations. Monitor for updates from the vendor for an official patch or guidance.