This vulnerability in tagDiv Cloud Library (td-cloud-library) involves improper neutralization of input during web page generation, leading to a DOM-based Cross-site Scripting (XSS) issue. It affects all versions up to and including 3.9.4. The vulnerability allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change with low confidentiality, integrity, and availability impacts. No patch or official remediation has been disclosed yet.

Successful exploitation of this DOM-based XSS vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser within the context of the vulnerable web application. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The vulnerability requires user interaction and does not require privileges, but it can affect the security context of the application (scope change). No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and output encoding controls where possible to mitigate DOM-based XSS risks. Monitor vendor communications for updates on patches or official mitigations.