This vulnerability in Hyve5 Leantime up to version 3.9.8 allows an attacker with 'EDIT' permissions to inject malicious JavaScript code into the project dashboard via a label name. The injected script executes in the context of other users viewing the dashboard, resulting in a cross-site scripting attack. The vulnerability is located in the show.blade.php template file of the Project Dashboard component, where input is echoed raw without sanitization. The vulnerability has been publicly disclosed, but no vendor response or patch has been provided.

Successful exploitation can lead to cross-site scripting attacks affecting users who view the poisoned project dashboard. This could allow attackers to execute arbitrary scripts in the context of other users, potentially leading to session hijacking, unauthorized actions, or data theft. However, exploitation requires the attacker to have 'EDIT' permissions, limiting the attack vector to users with elevated privileges. The CVSS score is 4.8 (medium severity), reflecting the moderate impact and required privileges.

No official fix or patch is currently available, and the vendor has not responded to the disclosure. Users should restrict 'EDIT' permissions to trusted individuals only and consider monitoring or limiting access to the project dashboard until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.