This vulnerability in Daniel Brendel's HortusFox product involves stored cross-site scripting (CWE-79) due to unsafe rendering of plant notes by Parsedown without safe mode enabled. Authenticated users can inject persistent JavaScript code into notes, which executes in the browsers of any users viewing those notes. This can lead to session cookie theft or unauthorized actions performed in the context of other users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with partial impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

An attacker with authenticated access can inject malicious JavaScript that executes in other users' browsers when they view affected plant notes. This can result in theft of session cookies or unauthorized actions performed with the privileges of other users, including administrators. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted individuals only and consider disabling or limiting note rendering features that use Parsedown without safe mode. Monitor for updates from the vendor for an official fix.