This vulnerability in HCL Notes arises from improper input neutralization during web page generation, leading to reflected cross-site scripting (CWE-79). Successful exploitation enables an attacker to run arbitrary JavaScript code within the security context of another user, potentially leading to session hijacking or other client-side attacks. The affected version is HCL Notes Release 12.0.2FP5HF8 on Linux 4.18.0-553.52.1.El8_10.X64_64#1. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack traceability, no privileges required, user interaction required, and high scope impact on integrity and availability. No vendor remediation or patch is currently documented.

An attacker exploiting this vulnerability can execute arbitrary JavaScript in the context of a victim user, which may lead to theft of user credentials, session tokens, or other sensitive information accessible via the browser. The impact is limited to the affected user's session and does not escalate privileges on the server. The medium CVSS score reflects the moderate risk due to required user interaction and no direct impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should exercise caution when interacting with untrusted content or links within HCL Notes. Implementing web application firewalls or input validation proxies may provide temporary mitigation, but no vendor-official mitigation is currently documented.