The vulnerability arises from improper input validation and unsafe HTML rendering in the skills-service platform. Specifically, raw user input from registration fields (firstName, lastName, nickname) is stored without HTML sanitization and later interpolated into HTML templates without encoding, then rendered using Vue's v-html directive, which sets innerHTML. This enables three escalating attack paths: (1) basic XSS via self-contained payloads executed when an admin visits the Quiz Runs page; (2) remote script loading using split-field techniques to load arbitrary JavaScript from an attacker-controlled server, enabling full admin control actions; (3) theft of XSRF tokens via eval and window.name manipulation, allowing the attacker to perform admin API calls from the victim's browser. The vulnerability is fixed in version 4.4.2.

Successful exploitation allows an attacker to execute arbitrary JavaScript in an administrator's browser, leading to potential full administrative control over the platform, including deleting projects, creating backdoor accounts, dumping user data, and installing keyloggers. Additionally, attackers can steal XSRF tokens to perform unauthorized API actions. The session cookie is HttpOnly and protected, but the XSRF token is exposed and leveraged for attacks. No phishing or extra admin interaction is required beyond routine use.

The vendor has released a patch in version 4.4.2 that addresses these vulnerabilities. Since the skills-service is a cloud-hosted platform, the vendor manages remediation server-side. Users should verify that their service is updated to version 4.4.2 or later and follow any vendor advisory instructions. Patch status is confirmed as available and applied by the vendor.