The vulnerability exists in badlogic pi-mono 0.58.4 in the SVG Artifact Handler component, specifically in an unknown function of the file packages/web-ui/src/tools/artifacts/SvgArtifact.ts. This flaw allows remote attackers to perform cross-site scripting (XSS) attacks by manipulating input that is improperly handled, leading to script execution in the context of the affected application. The vulnerability requires no privileges and no user interaction other than viewing the crafted content. The vendor has been contacted but has not issued any advisory or patch, and no official remediation is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the impact is limited to the scope of the XSS and does not include privilege escalation or server compromise. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3.

No official fix or patch is currently available from the vendor. Users should monitor vendor communications for any future updates. In the meantime, applying web application firewalls (WAF) rules to detect and block XSS payloads targeting the SVG Artifact Handler may help mitigate risk. Avoid exposing the vulnerable component to untrusted users if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.