This vulnerability exists in the index function of app/sw.py in kagisearch smallweb, where improper handling of the qs argument in query string rendering leads to cross-site scripting. Attackers can exploit this remotely by sending raw HTTP requests containing unencoded double-quote characters, which are normally percent-encoded by browsers but accepted by Werkzeug's request.query_string. The project follows a rolling release strategy, so no discrete affected versions are specified. A patch identified by commit 00b68144e583f20a6b67e29cf01bc07f57979ffb addresses the issue. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3.

Successful exploitation allows remote attackers to perform cross-site scripting attacks, potentially leading to script execution in the context of the vulnerable web application. This can result in user session hijacking or other client-side impacts. However, exploitation requires specially crafted raw HTTP requests that bypass normal browser encoding, limiting attack vectors.

A patch is available (commit 00b68144e583f20a6b67e29cf01bc07f57979ffb) and should be applied to remediate this vulnerability. Since the product uses a rolling release model, users should update to the latest version incorporating this patch. No other mitigation steps are indicated by the vendor advisory.