The vulnerability exists in badlogic pi-mono 0.58.4 in the SVG Artifact Handler component, within an unspecified function in the file packages/web-ui/src/tools/artifacts/SvgArtifact.ts. The flaw allows cross-site scripting attacks, enabling remote attackers to inject and execute malicious scripts. The vendor was notified but has not issued any fix or advisory. No patch or remediation guidance is currently available, and the exploit details have been publicly disclosed.

Successful exploitation of this vulnerability could allow remote attackers to perform cross-site scripting attacks, potentially leading to script execution in the context of the affected application. This may result in user session hijacking, defacement, or other client-side impacts. However, the vulnerability does not require privileges or user interaction beyond UI interaction and has a medium severity rating (CVSS 5.3).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider applying application-level mitigations such as input validation and output encoding where possible. Monitor official vendor channels for updates or patches.