This vulnerability in x-ui 0.3.2 arises from the reflection of the raw request URI into a client-side template binding expression without effective sanitization. Although server-side HTML entity escaping is applied, it is ineffective because the browser decodes these entities before the client-side framework processes the content as JavaScript code. Consequently, an authenticated user visiting a maliciously crafted URL can trigger arbitrary script execution in the same-origin context of the management interface. This can enable attackers to steal sensitive data or perform unauthorized actions leveraging the victim's session privileges.

Exploitation allows arbitrary script execution within the management interface's same-origin context for authenticated users. This can lead to theft of sensitive data accessible through the interface and unauthorized actions performed with the victim's session privileges. The vulnerability requires the victim to be logged in and to visit a crafted URL, limiting the attack vector to authenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid visiting untrusted URLs while logged into the management interface. Monitor vendor communications for updates regarding an official fix or mitigation.