This vulnerability (CVE-2026-54188) is an unauthenticated Cross-Site Scripting (XSS) issue in Jetimpex Inc.'s JetEngine product, affecting all versions up to 3.8.10 inclusive. It is classified under CWE-79, indicating improper neutralization of input during web page generation. The CVSS 3.1 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at low levels. No patch or official remediation has been disclosed as of the publication date.

The vulnerability allows an unauthenticated attacker to inject malicious scripts into web pages generated by JetEngine, potentially leading to the execution of arbitrary scripts in the context of the victim's browser. This can result in limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. Since no known exploits are reported in the wild, the practical impact may currently be limited but remains a significant risk due to the unauthenticated nature of the flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or mitigations recommended by the vendor. Monitoring vendor communications for updates is advised.