CVE-2026-66673: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Monkeysan Flatastic

CVE-2026-66673 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in Monkeysan Flatastic versions up to 2.0. The flaw arises from improper neutralization of input during web page generation, allowing attackers to execute arbitrary scripts in the context of the affected application. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system. As an unauthenticated XSS, it can be triggered by remote attackers without credentials, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser context.

No patch or official remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation or output encoding workarounds if feasible.